GCVE-110-OSM-2026-10506

On require/import, the package spawns a bundled 1.1 MB Windows executable at vendor/nanocache.exe as a detached background process with stdio ignored, windowsHide set, and child.unref() so it survives parent exit. The declared purpose is an in-memory LRU+TTL cache, which does not require a native background process, and the binary is not built from source shipped in the tarball. Strings inside the executable include `/ws/agent`, `disconnect`, `update`, and `exit_code`, consistent with a WebSocket-based remote agent that accepts commands from a remote controller. The README further describes vendor/nanocache.exe as a drop-in slot for an arbitrary Windows executable, indicating the npm module functions as a generic launcher for the bundled binary. Installing or importing the package on a Windows host results in an opaque, hidden native process being launched under a cache-library cover story, giving a remote party persistent control over the installer's machine. Judge assessment: This looks like a disguised remote-agent launcher: on import the package starts `vendor/nanocache.exe` as a detached background process with `stdio: "ignore"`, `windowsHide: true`, and `child.unref()`, which is unnecessary for a cache library and designed to survive parent exit. The bundled executable is opaque and not built from source in the tarball, while the extracted strings include and `WinHttp*`, `RegCreateKeyExW`, and `RegSetValueExW`, indicating networked persistence-capable behavior under a benign LRU+TTL cover story. The attacker model is a publisher shipping a trojanized npm package that installs a hidden Windows agent for remote control or monitoring of the victim host. The metadata also fits a fresh one-package account with no repository and a single version, reinforcing that this is a staged malicious drop rather than a normal cache utility. ENTRY dist/index.cjs (main: ./dist/index.cjs) EXFIL - System Information Collection in dist/index.cjs: "process.platform" - System Information Collection in dist/index.js: "process.platform" ADDITIONAL FINDINGS - Stealth Background Process Spawning in dist/index.js: "spawn(exe, [...options.args ?? []], { detached: true, // its own process group, ..." - Binary: Injection in vendor/nanocache.exe: "VirtualProtect failed with code 0x%x" - Shell Command Execution in dist/index.cjs: "require("child_process")" - Silent Process Execution in dist/index.cjs: "stdio: "ignore"" - Detached Child Process Payload in dist/index.js: "spawn(exe, [...options.args ?? []], { detached: true" - Binary: Shell in vendor/nanocache.exe: "[shell] PowerShell session started (UTF-8, pipeline mode)" (+3 more) PAYLOAD FILES vendor/nanocache.exe (+ dist/index.js, dist/index.cjs)