GCVE-110-OSM-2026-10239

This package is a confirmed DPRK/Lazarus PolinRider/nullreceiver campaign implant masquerading as a PostCSS plugin. The actual payload is hidden after hundreds of whitespace characters in index.js and uses unicode-escaped strings to conceal child_process.spawn, http/https requests, and an Ethereum address (0xa322e5f3d311d3080e6f0121063e9adc2490ef1a). The C2 resolution mechanism is novel and sophisticated: it queries multiple Ethereum RPC endpoints to find a transaction FROM the hardcoded attacker address, then decodes the transaction's `to` field as raw bytes to reconstruct two IPv4 addresses, which are then set as globals (_H, _H2, _t_s, _t_u) for subsequent C2 communication — a blockchain-based C2 dead-drop. Campaign markers global['_V'] (PolinRider) and the nullreceiver key string 'q4FZkxX{!h,Sr3=@' are both present, and the publisher 'brownroger' already has a confirmed critical-severity malicious package (post-css-transfer) in OSM APT malware detected: PolinRider, nullreceiver. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY index.js (default-index: index.js) DESTINATION - 13 exfil (custom-c2, ethereumAddresses) (values recorded in verified_iocs) EXFIL - Network Request in index.js: "http.request(" OBFUSCATION - Decoded Unicode Escape Content in index.js (x20) - IOCs Found in Deobfuscated Code in index.js - Whitespace-Padded Hidden Payload in index.js: "; global" - Dynamic Base64 Decoding in index.js: "Buffer.from(n,"base64")" - Unicode Escape Obfuscation in index.js: "\u0068\u0074\u0074\u0070\u0073" - Obfuscation patterns: unicodeHeavy in index.js - recovered 9 urls, 10 domains, 1 ipv4, 1 ethereumAddresses, 6 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Global Require Alias in index.js: "global['r']=require" - Campaign marker: PolinRider in index.js: "global['_V']" - Campaign marker: nullreceiver in [deobfuscated] index.js: "q4FZkxX{!h,Sr3=@" - Dynamic Code Execution in index.js: "eval(r+" - Brand New Package - Publisher Has Other Malicious Packages PAYLOAD FILES index.js