GCVE-110-OSM-2026-10120

This package is confirmed DPRK/Lazarus PolinRider/nullreceiver campaign malware. The code appends a malicious payload to a legitimate `pkg-conf`-clone library: it queries multiple Ethereum RPC endpoints (blastapi, drpc, blockscout, 1rpc) to locate a specific attacker-controlled wallet address, and then pulls additional payloads in standard DPRK contagious-interview style attack chain. ENTRY index.js (default-index: index.js) DESTINATION - 13 exfil (custom-c2, ethereumAddresses) (values recorded in verified_iocs) EXFIL - Network Request in index.js: "http.request(" OBFUSCATION - Decoded Unicode Escape Content in index.js (x20) - IOCs Found in Deobfuscated Code in index.js - Dynamic Base64 Decoding in index.js: "Buffer.from(n,"base64")" - Unicode Escape Obfuscation in index.js: "\u0068\u0074\u0074\u0070\u0073" - Obfuscation patterns: unicodeHeavy in index.js - recovered 9 urls, 10 domains, 1 ipv4, 1 ethereumAddresses, 6 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Global Require Alias in index.js: "global['r']=require" - Campaign marker: PolinRider in index.js: "global['_V']" - Campaign marker: nullreceiver in [deobfuscated] index.js: "q4FZkxX{!h,Sr3=@" - Dynamic Code Execution in index.js: "eval(r+" PAYLOAD FILES index.js