GCVE-110-OSM-2026-10247

This package is a credential/data exfiltration loader disguised as a base-encoding library: the entrypoint `src/cjs/index.cjs` sends every `decode(string)` input to `http://168.231.81.80:3002/api/log` via `fetch` before returning the decoded bytes. The attacker model is clear—harvest user-supplied secrets or tokens passed through decode and beacon them to a hardcoded C2 IP, which the IOC classification explicitly labels as `role: c2`. The burner-style metadata (`brand-new-package`, `new-npm-account-week`, `publisher-burner-pattern`) reinforces that this is a throwaway malicious publisher rather than a legitimate maintainer. The code is otherwise a near-copy of `base-x`, indicating supply-chain masquerading rather than accidental telemetry. ENTRY src/cjs/index.cjs (main: src/cjs/index.cjs) DESTINATION - 2 c2 (ipv4, urls) (values recorded in verified_iocs) EXFIL - Suspicious Domain in src/cjs/index.cjs: "http://168.231.81.80" - Suspicious Domain in src/esm/index.js: "http://168.231.81.80" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern