GCVE-110-OSM-2026-10238

This looks like a supply-chain implant in a package that should only do base encoding/decoding: the entrypoint is packed with multi-layer obfuscation, indirect `Function['constructor']` access, and a large base64 blob rather than normal library code. The decoded payload visibly contains a hard-coded IP, and uses `fetch`, `POST`, and references to `console`/`error`, which is consistent with exfiltrating data to an attacker-controlled IP. The attacker model is a malicious npm publisher using a burner account (`minimantis`) to ship a trojanized dependency that masquerades as `base-x`/`base65` utilities. The obfuscation in both `src/cjs/index.cjs` and `src/esm/index.js`, plus the brand-new publisher and package, strongly corroborate intent rather than an accidental minifier artifact. ENTRY src/cjs/index.cjs (main: src/cjs/index.cjs) OBFUSCATION - Obfuscation (osm-deobfuscator): NiceGUI Multi-layer Obfuscation in src/cjs/index.cjs - Obfuscation (osm-deobfuscator): NiceGUI Multi-layer Obfuscation in src/esm/index.js - Base64 Encoded Payload in src/cjs/index.cjs: "'rqwKqrwCBCQIOmh0dHBzOi8vNDYuMjUwLjI1My42My9hcGkvbG9nCApmZXRjaAgIUE9TVAgMbWV0aG9..." - String Array Obfuscation in src/cjs/index.cjs: "FG[FL-0x1]" - Base64 Encoded Payload in src/esm/index.js: "'rqwKqrwCBCQIOmh0dHBzOi8vNDYuMjUwLjI1My42My9hcGkvbG9nCApmZXRjaAgIUE9TVAgMbWV0aG9..." - String Array Obfuscation in src/esm/index.js: "FG[FL-0x1]" - Deobfuscation Failed in src/cjs/index.cjs - Deobfuscation Failed in src/esm/index.js (+2 more) ADDITIONAL FINDINGS - Indirect Function Constructor Access in src/cjs/index.cjs: "['constructor']" - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES src/cjs/index.cjs (+ src/esm/index.js)