GCVE-110-OSM-2026-10246

This looks like a supply-chain trojan masquerading as a base-encoding library: the attacker model is a publisher shipping a compromised npm package to execute a hidden loader on import. The entrypoint in `src/cjs/index.cjs` contains a huge obfuscated blob plus an embedded URL to a hard coded IP address and `fetch`/`POST`/`headers` strings, which is consistent with runtime exfiltration or beaconing rather than normal base-x logic. The repeated `['constructor']` access in both `src/cjs/index.cjs` and `src/esm/index.js`, together with the `NiceGUI Multi-layer Obfuscation` hit and deobfuscation failure, strongly supports deliberate concealment. Metadata also fits a burner-account campaign: `minimantis` is a brand-new publisher with near-duplicate packages like `base65-11x`, `base65-12x`, and `base65-13x`, which is a classic supply-chain attacker pattern. ENTRY src/cjs/index.cjs (main: src/cjs/index.cjs) OBFUSCATION - Obfuscation (osm-deobfuscator): NiceGUI Multi-layer Obfuscation in src/cjs/index.cjs - Obfuscation (osm-deobfuscator): NiceGUI Multi-layer Obfuscation in src/esm/index.js - Base64 Encoded Payload in src/cjs/index.cjs: "'wsHJmLwCBCQIQmh0dHA6Ly80Ni4yNTAuMjUzLjYzOjMwMDAvYXBpL2xvZwgKZmV0Y2gICFBPU1QIDG1..." - String Array Obfuscation in src/cjs/index.cjs: "fx[fs-0x1]" - Base64 Encoded Payload in src/esm/index.js: "'wsHJmLwCBCQIQmh0dHA6Ly80Ni4yNTAuMjUzLjYzOjMwMDAvYXBpL2xvZwgKZmV0Y2gICFBPU1QIDG1..." - String Array Obfuscation in src/esm/index.js: "fx[fs-0x1]" - Deobfuscation Failed in src/cjs/index.cjs - Deobfuscation Failed in src/esm/index.js (+2 more) ADDITIONAL FINDINGS - Indirect Function Constructor Access in src/cjs/index.cjs: "['constructor']" - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES src/cjs/index.cjs (+ src/esm/index.js)