GCVE-110-OSM-2026-9899

This package hides an obfuscagted payload in the lib/core.js file which curl's a package.json manifest file and then installs malicious packages from internet sources. ENTRY index.js (main: index.js) EXFIL - Network Request in lib/core.js: "https.get(" - System Information Collection in lib/core.js: "os.hostname()" - System Information Collection in lib/helpers.js: "os.hostname()" OBFUSCATION - Dynamic Base64 Decoding in lib/helpers.js: "Buffer.from(str, 'base64')" - Obfuscation Successfully Evaded Deobfuscation in lib/helpers.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in lib/core.js: "spawn(cscript, args, { detached: true, stdio: 'ignore', windowsHide: true, windo..." - Shell Command Execution in lib/core.js: "require('child_process')" - Silent Process Execution in lib/core.js: "stdio: 'ignore'" - Detached Child Process Payload in lib/core.js: "spawn(cscript, args, { detached: true" PAYLOAD FILES lib/core.js