GCVE-110-OSM-2026-10476

index.js exports a listen(clientId) function that subscribes to https://ntfy.sh/dv-141u30-admin-cmd-<clientId>/sse via EventSource and, on receiving messages with action 'EVAL_CODE', passes the message payload to eval() and new Function() — executing attacker-supplied JavaScript in the loading context. Execution results are POSTed back to https://ntfy.sh/dv-141u30-admin-status-<clientId>. The clientId is a 7-digit value persisted in localStorage as g_live_username. Any application bundling this package ships a remote command-and-control channel to end-user browsers: whoever knows or enumerates a client's topic can run arbitrary JavaScript in that browser and receive the results, with no integrity check, origin restriction, or user confirmation. Judge assessment: This package implements a remote command-and-control channel for browser code execution: the OSV advisory describes `listen(clientId)` subscribing to `https://ntfy.sh/dv-141u30-admin-cmd-<clientId>/sse` and dispatching attacker messages with action `EVAL_CODE` into `eval()` and `new Function()`. The entrypoint also shows direct network reachability to `ntfy.sh` and a hardcoded CDN-backed loader that pulls `final.json`, `colors.json`, and `index.wasm`, which is consistent with a remote-controlled payload delivery model rather than a normal utility library. The attacker model is clear: anyone who can know or enumerate the client topic can execute arbitrary JavaScript in end-user browsers and receive results on `https://ntfy.sh/dv-141u30-admin-status-<clientId>`. The obfuscated URL reconstruction and recent multi-version publish pattern reinforce that this is not a false positive but a deliberately distributed remote execution package. ENTRY index.js (main: index.js) DESTINATION - 5 exfil (reconstructed) - 1 c2 (domains) (values recorded in verified_iocs) OBFUSCATION - Obfuscation (osm-deobfuscator): unknown in index.js - recovered 5 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in index.js: "https://gcore.jsdelivr.net/gh/divineubg/dva/final.json" PAYLOAD FILES index.js