GCVE-110-OSM-2026-9898

This package implements a multi-stage dropper/loader. On import, index.js silently requires `_helpers.js`, which fingerprints the OS/arch, downloads a platform-specific binary from obfuscated Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, etc.) or via DNS TXT record exfiltration from well1.site subdomains, writes it to /var/tmp or %TEMP% with a randomized name disguised as 'dotnet_diag_*.exe' or '.cache_*', marks it executable, and launches it as a detached background process with suppressed I/O so it survives parent exit. The `lib/telemetry.js` file adds persistence via .profile and contains 126 obfuscated strings recovered by deobfuscation. The publisher account 'jw1wzrmssqdo' has zero other packages and a disposable-looking email domain, fitting the throwaway-account attacker model used in supply-chain campaigns. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in _helpers.js: "https.get(" - Network Request in lib/telemetry.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Strings Extracted from Deobfuscated Code in lib/telemetry.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in _helpers.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", w..." - Shell Command Execution in _helpers.js: "require("child_process")" - Silent Process Execution in _helpers.js: "stdio: "ignore"" - Detached Child Process Payload in _helpers.js: "spawn("cmd.exe", ["/c", "start", "/b", fp], { detached: true" - Shell Command Variable Setup in _helpers.js: ""cmd.exe", ["/c", "start", "/b", fp], { detached: true, stdio: "ignore", windows..." PAYLOAD FILES lib/telemetry.js (+ _helpers.js)