GCVE-110-OSM-2026-10483

This package is a typosquat of the legitimate tailwindcss/tailwindcss-forms repository, published by a brand-new account (rocined536@dnsink.com, 1 day old) with a single package. The entrypoint src/index.js is heavily obfuscated with obfuscator.io (1621 hex variable names, proxied array-function replacements) and contains confirmed DPRK/Lazarus campaign markers: 'q4FZkxX{!h,Sr3=@' (nullreceiver campaign) and 'global[\'_V\']' (PolinRider campaign). Deobfuscation recovered 36 IOCs including multiple Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) and a hardcoded Ethereum address (0xa322e5f3d311d3080e6f0121063e9adc2490ef1a classified as exfil), consistent with a cryptocurrency-draining payload that queries victim wallet state and exfiltrates funds to an attacker-controlled address. The pattern — obfuscated payload appended to a cloned legitimate library, Ethereum drainer targeting, DPRK campaign markers — is characteristic of the Contagious Interview / Lazarus supply chain attack model. ENTRY src/index.js (main: src/index.js) DESTINATION - 1 exfil (ethereumAddresses) - 13 fetched-payload (deobfuscated) (values recorded in verified_iocs) OBFUSCATION - IOCs Found in Deobfuscated Code in src/index.js - Obfuscation: augmented proxied array function replacements in src/index.js - Obfuscation (osm-deobfuscator): obfuscator-io in src/index.js - String Array Obfuscation in src/index.js: "['6f0121063e','Mozilla/5.','vsVto','BoIAd','GGFaB','ZFXMR','createInfl','cpUBI',..." - Unicode Escape Obfuscation in src/index.js: "\u0068\u0074\u0074\u0070\u0073\u003A" - Decoded Unicode Escape Content in src/index.js - Obfuscation patterns: hexVariables in src/index.js - recovered 2 ipv4, 7 urls, 13 domains, 1 ethereumAddresses, 13 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Global Require Alias in src/index.js: "global['r']=require" - Campaign marker: nullreceiver in [deobfuscated] src/index.js: "q4FZkxX{!h,Sr3=@" - Campaign marker: PolinRider in [deobfuscated] src/index.js: "global['_V']" - Dynamic Code Execution in scripts/release-channel.js: "exec(version)" - Very New NPM Publisher Account PAYLOAD FILES src/index.js