{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-OSM-2026-6489","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-06-21T22:58:36Z","dateUpdated":"2026-11-07T03:37:24Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"The package presents as a functional AI agent framework — a plausible Contagious Interview / FNOS attacker model — but `dist/channels/feishu.js` is obfuscated while no other channel adapter file is, and deobfuscation recovered a hardcoded Feishu webhook URL (`open.feishu.cn/open-apis/bot/v2/hook/43a9288c-64b5-4344-9b8f-f27bf75b10ca`) that the FNOS rule matched. Critically, the IOC is hardcoded inside obfuscated code rather than read from the user-configured `~/.lisa/channels.json`, distinguishing it from the legitimate channel adapter the CLI advertises. The FNOS malware family — associated with DPRK Contagious Interview campaigns — specifically uses Feishu webhooks as C2 beacons, and the deobfuscation outcome of `iocs-recovered` confirms real hidden indicators were extracted rather than just pattern-matched. The remaining findings (cron installation, PTY spawn, shell exec, detached process) are individually explainable by the AI agent use case, but the obfuscated Feishu beacon in isolation is sufficient for a malicious determination.\n\nENTRY\n  dist/cli.js (bin: dist/cli.js)\n\nPERSISTENCE\n  - Startup Persistence in completions/_lisa: \".zshrc\"\n  - Startup Persistence in completions/lisa.bash: \".bashrc\"\n  - Cron Job Persistence in dist/heartbeat/install.js: \"crontab -\"\n\nDESTINATION\n  - telegram-bot: api.telegram.org/bot${token}`; (primary, plaintext) in dist/channels/telegram.js\n  - custom-c2: https://takoapi.com/dashboard. (plaintext) in dist/tools/takoapi.js\n  - custom-c2: https://takoapi.com/dashboard (plaintext) in dist/tools/takoapi.js\n  - custom-c2: http://host:5757/?token=... (plaintext) in dist/web/server.js\n  - custom-c2: html.duckduckgo.com (plaintext) in dist/tools/web_search.js\n  - urls: https://takoapi.com (c2, plaintext)\n  - domains: open.feishu.cn (c2, plaintext)\n  - domains: takoapi.com (c2, plaintext)\n\nEXFIL\n  - Reverse Shell in dist/agents/pty.js: \"pty.spawn(\"\n  - Corporate Environment Targeting in dist/tools/set_mood.js: \"tMoodTool = { name: \"set_mood\", description: \"Update Lisa's visible avatar to ma...\"\n  - Environment Variable Exfiltration in dist/tools/takoapi.js: \"process.env.TAKOAPI_BASE_URL ?? DEFAULT_BASE).replace(/\\/$/, \"\"); } const defaul...\"\n  - Data Encoding for Exfiltration in dist/cli/agents-pty.js: \"encodeURIComponent(id)}/stream\"\n  - Data Encoding for Exfiltration in dist/tools/github_link.js: \"encodeURIComponent(opts.ref)}` : base\"\n  - Data Encoding for Exfiltration in dist/tools/takoapi.js: \"encodeURIComponent(query\"\n  - Data Encoding for Exfiltration in dist/tools/web_search.js: \"encodeURIComponent(input.query\"\n  - Data Encoding for Exfiltration in dist/web/island.js: \"encodeURIComponent(slug) + '.png\"\n  (+34 more)\n\nOBFUSCATION\n  - IOCs Found in Deobfuscated Code in dist/channels/feishu.js\n  - Dynamic Base64 Decoding in dist/channels/feishu.js: \"Buffer.from(encrypted, \"base64\")\"\n  - Unicode Escape Obfuscation in dist/web/lisa-client.d.ts: \"\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u...\"\n  - Unicode Escape Obfuscation in dist/web/lisa-css.d.ts: \"\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u...\"\n  - Unicode Escape Obfuscation in dist/web/lisa-html.d.ts: \"\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u...\"\n  - recovered 1 domains, 1 _domainCandidates from decoded/deobfuscated content\n\nADDITIONAL FINDINGS\n  - FNOS Crypto-Obfuscated Malware Family in dist/channels/feishu.d.ts: \"open.feishu.cn\"\n  - Download Execute Delete Pattern in dist/sandbox/sandbox.js: \"writeFile(tmp, policy, \"utf8\"); return { command: \"/usr/bin/sandbox-exec\", args:...\"\n  - Shell Command Execution in dist/cli/doctor.js: \"execSync(\"\n  - Platform Detection with Data Collection in dist/cli/pair.js: \"JSON.stringify({ name, platform: \"ios\"\n  - Dynamic Code Execution in dist/cli.js: \"exec(src)\"\n  - Detached Child Process Payload in dist/tools/dispatch_agent.js: \"spawn(cmd, args, { cwd, detached: true\"\n  (+1 more)\n\nPAYLOAD FILES\n  dist/channels/feishu.js (+ dist/web/server.js, dist/tools/takoapi.js)\n\nINDICATORS (IOCs)\n  - ipv6: 0:0:0:0:0:0:0:1, 9::, 1A::, 7::, 1:: (+17 more)\n  - urls: https://www.volcengine.com/product/ark, https://t.me/BotFather, https://ollama.com, https://api.deepseek.com/v1, https://api.mistral.ai/v1 (+15 more)\n  - domains: www.volcengine.com, message.im, ollama.com, api.deepseek.com, ark.cn-beijing.volces.com (+14 more)\n  - emails: 7@n.Tw, m@y.mk, 7@NR.Nl\n  - payloadFileHash: ce53e32727a49a1b3546b7372d7f6c323ae169fc159b6599be26d115b921dd87","supportingMedia":null}],"references":[{"url":"https://opensourcemalware.com/threats/7ea4b132-c54c-483b-b6b2-1b01ef12a4df","name":"Malicious npm package: @oratis/lisa","tags":["advisory"]},{"url":"https://registry.npmjs.org/@oratis/lisa","name":"","tags":["vendor"]}],"metrics":[{"format":"CVSS_V3","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"unknown","product":"@oratis/lisa","collectionURL":"https://registry.npmjs.org","packageName":"@oratis/lisa","repo":"npm/@oratis/lisa","defaultStatus":"affected","versions":[{"version":"0.12.0","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}