GCVE-110-OSM-2026-10259

This package is a typosquat of the legitimate tailwindlabs/tailwindcss-forms, is a DPRK Contagious Interview style package that uses the Nullreceiver mechanism to hide its second stage loader. The attacker model is stealthy C2 via blockchain-derived IP resolution to evade static IOC blocklists. The src/index.js file contains a multi-layer base64-encoded payload executed via eval(atob(...)) that, when decoded, implements a full Ethereum blockchain monitor: it queries multiple public ETH RPC endpoints to watch for transactions from a hardcoded wallet address (0xa322e5f3d311d3080e6f0121063e9adc2490ef1a), extracts a C2 IP address encoded in the transaction's 'to' field, then connects to that dynamic IP on ports 80/443 to fetch and execute a remotely-delivered XOR-encrypted payload via spawn('node', ['-e', ...]) with detached:true. Two confirmed campaign markers are present in the deobfuscated code: 'q4FZkxX{!h,Sr3=@' (nullreceiver, DPRK/Lazarus) and 'global["_V"]' (PolinRider, DPRK/Lazarus), placing this firmly within the Lazarus/Contagious Interview threat cluster. ENTRY src/index.js (main: src/index.js) DESTINATION - 1 exfil (ethereumAddresses) - 6 fetched-payload (deobfuscated) (values recorded in verified_iocs) OBFUSCATION - Decoded Base64 Content in src/index.js - IOCs Found in Deobfuscated Code in src/index.js - Dynamic Base64 Decoding in src/index.js: "eval(atob" - Base64 Encoded Payload in src/index.js: ""Z2xvYmFsLmk9IkExMS0tISI7Z2xvYmFsLnI9cmVxdWlyZTt0eXBlb2YgbW9kdWxlPT09Im9iamVjdCI..." - Obfuscation (osm-deobfuscator): unknown in src/index.js - recovered 13 urls, 1 ips, 11 domains, 1 ipv4, 1 ethereumAddresses, 6 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Base64 Decoded Eval in src/index.js: "eval(atob(" - Campaign marker: nullreceiver in [deobfuscated] src/index.js: "q4FZkxX{!h,Sr3=@" - Campaign marker: PolinRider in [deobfuscated] src/index.js: "global['_V']" - Dynamic Code Execution in scripts/release-channel.js: "exec(version)" - Very New NPM Publisher Account PAYLOAD FILES src/index.js