GCVE-110-OSM-2026-10532

The package ships a single obfuscator.io-style `index.js` with a rotated string array, RC4 key-schedule + XOR string decoder, self-defending anti-debug wrapper, and per-call proxy functions. All identifiers (the `require` target, the HTTP method name, and the destination URL) are reconstructed at runtime from ~130 encoded literals, hiding the actual network destination from static inspection. The sole exported function `connet(x)` unconditionally issues `axios.get(API_BASE_URL + x)` where `API_BASE_URL` is a URL assembled at runtime from ~13 RC4-decoded fragments. Any consumer that calls the package's public API sends its argument to a hardcoded author-controlled destination the caller did not configure. The README hint (`npm install evm_account`) and the name mismatch between the published package and its documented install string are consistent with an EVM/crypto-account-targeted exfiltration helper: a caller passing an account identifier, address, key material, or similar input to `connet()` will silently leak it to the obfuscated endpoint. The concealment of the destination behind RC4 decoding and anti-debug wrapping rules out an inadvertent, documented service call. Judge assessment: This package is consistent with an attacker-controlled exfiltration helper that hides its network destination behind obfuscation and then sends caller-supplied data out via `axios.get(...)`. The entrypoint `index.js` is an obfuscator.io-style blob with rotated string arrays, RC4/XOR decoding, and self-defending wrapper logic, which is far beyond normal npm library minification. The OSV advisory's description matches the visible structure in the file, and the package name `@ferudionz/web_logger_js` plus the documented `connet(x)` behavior suggest a credential or account-data theft model targeting whatever input the consumer passes in. I see no legitimate telemetry or analytics branding, and the concealment of the destination from static inspection is a strong indicator of deliberate malware. ENTRY index.js (main: index.js) OBFUSCATION - Obfuscation (osm-deobfuscator): obfuscator-io in index.js - Hex Encoded Strings in index.js: "'\x57\x50\x6c\x64\x51\x38\x6b\x69\x79\x4c\x4b'" - Unicode Escape Obfuscation in index.js: "\x77\x43\x6f\x2b\x6d\x74\x2f\x64\x51\x47" - Decoded Hex Escape Content in index.js (x136) - Strings Extracted from Deobfuscated Code in index.js - Obfuscation patterns: hexVariables, hexHeavy in index.js PAYLOAD FILES index.js