GCVE-110-OSM-2026-9961

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in lib/telemetry.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in setup.js: "process.env.TMP || "C:\\Windows\\Temp") : "/var/tmp"; let binary = null; const e..." - Network Request in lib/telemetry.js: "https.request(" - Network Request in setup.js: "https.get(" OBFUSCATION - Dynamic Base64 Decoding in lib/telemetry.js: "Buffer.from(chunks, "base64")" - Deobfuscation Failed in lib/telemetry.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in lib/telemetry.js: "spawn("cmd.exe", ["/c", "start", "/b", filePath], { detached: true, stdio: "igno..." - Silent Process Execution in lib/telemetry.js: "stdio: "ignore"" - Detached Child Process Payload in lib/telemetry.js: "spawn("cmd.exe", ["/c", "start", "/b", filePath], { detached: true" - Shell Command Variable Setup in lib/telemetry.js: ""cmd.exe", ["/c", "start", "/b", filePath], { detached: true, stdio: "ignore", w..." - Shell Command Execution in setup.js: "require("child_process")" - Very New NPM Publisher Account (+1 more) PAYLOAD FILES setup.js (+ lib/telemetry.js)