GCVE-110-OSM-2026-10609

Package is presented as a Tailwind CSS utility, but its default export `getPlugin` fetches JSON from a hardcoded bare-IP endpoint (https://31.97.137.157:45000/icons/109) and passes the returned `data.credits` field to `new Function(...)` bound with `require`, `process`, `module`, and `Buffer`, then invokes it. Following the README's instruction to register the default export as a Tailwind plugin causes Tailwind to invoke `getPlugin`, executing attacker-controlled JavaScript with full Node.js capabilities on the developer's machine. Cover-story framing (variables named `IconProvider`/`iconDomain`, a CDN hostname map for cloudflare/fastly/akamai/cloudfront, a `/ajax/libs/font-awesome/...` path fragment, a `bearrtoken: "logo"` header, and an unused `setDefaultModule` decoy) masks the loader as icon retrieval. Declared runtime dependencies (`@primno/dpapi`, `better-sqlite3`, `node-machine-id`) are consistent with browser-credential and cookie-stealer payloads that the fetched code can deploy. Judge assessment: This is a loader-style supply-chain implant: the default export `getPlugin` fetches attacker-controlled JSON from the hardcoded bare-IP endpoint `https://31.97.137.157:45000/icons/109` and executes `data.credits` with `new Function(...)` while explicitly binding `require`, `process`, `module`, and `Buffer`. The attacker model is a compromised npm package author delivering remote code execution to developers who register the package as a Tailwind plugin; the code is designed to run on install/use and provides full Node.js capabilities to the fetched payload. The decoy `setDefaultModule` CDN logic and `bearrtoken: "logo"` header are camouflage, not legitimate utility behavior, and the reconstructed exfil/C2 IOC is directly confirmed in the file contents. The new account metadata and lack of repository further support a malicious publish, not a false positive. ENTRY index.js (main: index.js) DESTINATION - 2 exfil (reconstructed) - 1 c2 (reconstructed) (values recorded in verified_iocs) OBFUSCATION - recovered 2 urls, 2 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in index.js: "https://cdnjs.31.97.137.157:45000/icons/109" - Very New NPM Publisher Account PAYLOAD FILES index.js