GCVE-110-OSM-2026-9821

This package is a classic supply-chain dropper masquerading as an internal Tinkoff UI component. The entrypoint (index.js) silently requires _adapter.js in a try/catch to hide errors, which then downloads a binary payload from obfuscated CDN hostnames (oob-worker.cf100-416.workers.dev, etc.) and falls back to DNS-over-TXT exfiltration from platform-specific subdomains of well1.site/l1.site. The downloaded binary is written to /var/tmp or %TEMP% with randomized filenames (dotnet_diag_<uid>.exe on Windows, .cache_<uid> on Linux/macOS), made executable, and launched as a detached background process with all I/O suppressed — a textbook malware launcher pattern. The lib/telemetry.js adds persistence via .profile modification and a second download/execution path. The publisher account (4r4rf0m8c4hm@web-library.net) is brand new with a single package, the version number (20.6.3) is implausibly high for a first-ever publish, and there is no repository link — all consistent with a dependency confusion or typosquatting attack targeting Tinkoff internal namespaces. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _adapter.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in _adapter.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Shell Command Execution in _adapter.js: "require("child_process")" - Silent Process Execution in _adapter.js: "stdio: "ignore"" - Detached Child Process Payload in _adapter.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _adapter.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES lib/telemetry.js (+ _adapter.js)