GCVE-VVD-OSM-2026-630

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. Payload: cit-base/src/api-support/api/recordsApi.ts Secondary files: playwright-employee-app/src/pages/create-record-page.ts, playwright-employee-app/src/pages/explore-reports-page.ts Key findings: - Environment Variable Exfiltration in cit-base/src/api-support/api/recordsApi.ts: "process.env.PLC_TEST_ENV, currentUserID: null, guestEmail: guestEmai..." - Dynamic Code Execution in playwright-employee-app/src/pages/create-record-page.ts: "exec(url)" - Dynamic Code Execution in playwright-employee-app/src/pages/explore-reports-page.ts: "exec(url)" - Dynamic Code Execution in playwright-employee-app/src/pages/record-type-settings-pages/record-types-settings.ts: "exec(url)" - Dynamic Code Execution in playwright-storefront-app/src/pages/public-record-page.ts: "exec(url)" IOCs: - ipv6: 2:: - urls: https://api.${process.env.PLC_TEST_SUBDOMAIN, https://${process.env.PLC_TEST_ENV, https://${process.env.CIT_OAUTH_HOST, https://mandrillapp.com/api/1.0`, https://playwright.dev/docs/test-configuration. (+22 more) - domains: opengov.com, login.vpctest.com, DateFormat.US, CurrencyFormat.US, DateFormat.AU (+45 more) - emails: api_admin@opengov.com, api_employee@opengov.com, api_guest@opengov.com, api_test@opengov.com, api_test@opedngov.com (+1 more) - binaryHashes: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 - payloadFileHash: a0b03dbf5c685917f5f6c4fc5f8f321ff0988caa3a0313dcff5116d960af8986