GCVE-110-OSM-2026-10360

This package masquerades as a logging/middleware utility (note `module.exports.pino = middleware` impersonating the pino logger) while its real payload is a 4MB+ obfuscator.io-obfuscated `lib/config.js` that executes immediately on `require('./lib/config')` from `index.js`. The obfuscated file contains `execSync` and the package also carries dynamic `exec(str)` execution in `lib/redaction.js`, forming a shell-execution chain hidden behind heavy hex encoding (268,060 escape sequences). The dependency `axios` is itself flagged malicious by OpenSourceMalware.com, providing a secondary payload vector. The IOC `http://192.168.1.42:9200` embedded in the package suggests reconnaissance or exfiltration targeting internal Elasticsearch endpoints, consistent with an insider-network targeting campaign. The publisher identity mismatch (npm account `debby0106`/`debbypuskar0106@outlook.com` vs. author `Harrison Thorn`/`harrisonthorn@protonmail.com`), single-package new account, no source repository, and a name typosquatting on `chai-as-promised` complete a classic supply-chain attack profile. ENTRY index.js (main: index.js) OBFUSCATION - Hex Encoded Strings in lib/config.js: "'\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x7..." - Unicode Escape Obfuscation in lib/config.js: "\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74..." - Obfuscation: obfuscator.io in lib/config.js - Obfuscation patterns: hexHeavy in lib/config.js ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Dynamic Code Execution in lib/redaction.js: "exec(str)" - Malicious Dependency Detected in package.json PAYLOAD FILES lib/redaction.js (+ lib/config.js)