GCVE-110-OSM-2026-10467

This package masquerades as a PostCSS plugin but embeds a heavily obfuscated payload hidden after 200+ whitespace characters in index.js. This is a classic DPRK Contagious Interview-style NPM package that is using the NullReceiver-style Ethereum stager to hide the next payload The deobfuscated payload reveals a cryptocurrency wallet drainer/stealer: it imports `child_process` (spawn), `zlib`, `http`/`https`, makes Ethereum RPC calls (`eth_getTransactionCount`, `eth_blockNumber`, `eth_getBlock`), queries Etherscan-style APIs (`?module=ac...on=txlist`), and communicates with attacker-controlled endpoints including `h.drpc.org` and `stapi.io` recovered from deobfuscation. The pattern `global['r']=require` / `global['i']=...` / `global['m']=module` is a classic obfuscated-malware bootstrapping technique to hide require calls. The publisher account `illiakalishchuk228` is brand new (< 1 day old) with a single package, and the author field is spoofed from the legitimate `postcss-initial` maintainer Maksim Koretskiy — a clear impersonation/typosquatting supply chain attack. ENTRY index.js (default-index: index.js) DESTINATION - 8 fetched-payload (deobfuscated) (values recorded in verified_iocs) OBFUSCATION - IOCs Found in Deobfuscated Code in index.js - Whitespace-Padded Hidden Payload in index.js: "; const" - Obfuscation (osm-deobfuscator): obfuscator-io in index.js - String Array Obfuscation in index.js: "['blockNumbe','stener','HnEZv','oYnfv','find','yRNZh','znPEY','Kit/537.36','\x20..." - Unicode Escape Obfuscation in index.js: "\u0068\u0074\u0074\u0070\u0073\u003A" - Decoded Unicode Escape Content in index.js - Obfuscation patterns: hexVariables in index.js - recovered 1 ipv4, 2 urls, 8 domains, 8 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Global Require Alias in index.js: "global['r']=require" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js