GCVE-110-OSM-2026-10282

This looks more like a potentially tampered package than a clearly malicious one: the main entrypoint is a normal libsignal-style export surface, but it conditionally runs `./install.installNewsletterAutoFollow()` from `index.js`, which is not expected in a crypto library. The only code-level anomaly is `src/session_record.js`, where dynamic base64 decoding (`Buffer.from(k, 'base64')`, `Buffer.from(key, 'base64')`) and deobfuscated hidden strings suggest concealment, but no concrete exfiltration destination or credential theft was recovered. The metadata is also weakly concerning because `@dreamguyxeon/libsignal-node` is brand-new, single-version, and has no repository, yet the publisher history does not show prior malicious packages. Attacker model: a supply-chain maintainer hiding an install-time modification or backdoor inside a repackaged dependency, but the current evidence stops short of proving payload theft or C2. ENTRY index.js (main: index.js) OBFUSCATION - Dynamic Base64 Decoding in src/session_record.js: "Buffer.from(k, 'base64')" - Strings Extracted from Deobfuscated Code in src/session_record.js PAYLOAD FILES src/session_record.js