GCVE-110-OSM-2026-10280

This package looks like a modified libsignal clone, but the entrypoint in index.js conditionally invokes ./install.js after a timeout, which is not normal for a crypto library and suggests an installer-side payload path. The strongest signal is obfuscation in src/session_record.js with dynamic base64 decoding and 17 recovered hidden strings, which is unusual for third-party npm source even though no exfil IOC was recovered. The attacker model is a supply-chain package author using a seemingly legitimate fork to hide runtime behavior or future payload hooks, but the current evidence does not expose a clear theft or beaconing routine. Given the single-version, no-repository metadata and the hidden-string layer, this warrants manual review rather than a clean bill of health. ENTRY index.js (main: index.js) OBFUSCATION - Dynamic Base64 Decoding in src/session_record.js: "Buffer.from(k, 'base64')" - Strings Extracted from Deobfuscated Code in src/session_record.js PAYLOAD FILES src/session_record.js