GCVE-110-OSM-2026-10137

The malicious npm package commonjs-assertion contains an obfuscated Node.js loader that connects to coolblast.zapto.org on port 8888. It downloads server-supplied JavaScript and executes the response directly in memory using new Function with access to Node.js require. The downloaded 6.2 MB second stage is a heavily obfuscated Node.js RAT. It provides persistent WebSocket command and control, victim registration, recursive filesystem scanning, archive creation, file exfiltration, Windows Run-key persistence, keylogging, clipboard monitoring, and periodic screenshot capture. The malware embeds PowerShell and C# code that calls user32.dll for keyboard and clipboard surveillance. Its JavaScript implementation and backdoor functionality are consistent with an OtterCookie-like payload and DPRK Contagious Interview tradecraft, but the exact malware-family attribution remains unconfirmed. It is not a conventional Python InvisibleFerret payload The first stage loads Node.js's http module and requests to a zapto.org address which accumulates the response body, compiles it with new Function("require", response), and executes it with unrestricted access to Node.js require. The downloaded second stage is a 6,246,668-byte bundled Node.js RAT. It uses WebSocket-based C2, registers the victim using a machine ID, hostname, platform, OS, and agent token, and supports filesystem discovery, ZIP/TAR collection, raw-file uploads, archive uploads, and request-correlated remote commands. Uploads use custom headers including X-Machine-Id, X-Agent-Token, X-Filename, X-Subdir, X-Source-Folder, and X-Raw-Upload. On Windows, it establishes per-user persistence under HKCU\Software\Microsoft\Windows\CurrentVersion\Run using MicrosoftCertificateService/MicrosoftCertSvc naming. Embedded PowerShell/C# implements a low-level keyboard hook, clipboard monitoring, and screenshot collection. WINDOWS PERSISTENCE PATH HKCU\Software\Microsoft\Windows\CurrentVersion\Run PERSISTENCE IDENTIFIER MicrosoftCertificateService PERSISTENCE VBS LAUNCHER MicrosoftCertSvc.vbs