GCVE-110-OSM-2026-10711

@next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter() function (mimicking next/font/google) decodes a base64 blob via atob(), then executes it through spawn('node','-e', code) with an eval(code) fallback. The decoded payload uses on-chain data as a C2 channel: it queries api.trongrid.io or fullnode.mainnet.aptoslabs.com for a transaction tied to hardcoded wallet addresses, retrieves that transaction's input data from BSC RPC endpoints (bsc-dataseed.binance.org, bsc-rpc.publicnode.com) via eth_getTransactionByHash, XOR-decrypts the returned bytes, and evals the resulting JavaScript. The result is arbitrary attacker-controlled code execution on any Node process that imports the package and invokes Inter(), with no relation to font functionality. Obfuscation (base64-hidden payload, node -e detached spawn with eval fallback, blockchain-mediated fetch) conceals the downloader from casual inspection. Judge assessment: This looks like a typosquatted npm package built for arbitrary code execution by a threat actor targeting developers who import a fake `@next-fonts/font` in place of Next.js font utilities. The entrypoint `index.js` decodes a hidden base64 blob, runs it with `spawn('node', ['-e', code], { detached: !0, stdio: 'ignore' })`, and falls back to `eval(code)`, which is classic loader behavior rather than font handling. The decoded payload reaches out to `api.trongrid.io`, `fullnode.mainnet.aptoslabs.com`, `bsc-dataseed.binance.org`, and `bsc-rpc.publicnode.com`, then XOR-decrypts transaction data and executes the result, giving the attacker remote arbitrary JavaScript execution. The brand-new account, rapid versioning, and obfuscation corroborate intent and make the OSV advisory credible. ENTRY index.js (main: index.js) OBFUSCATION - Decoded Base64 Content in index.js - Base64 Encoded Payload in index.js: ""Z2xvYmFsWyJfViJdPSJDNS10ZXN0IjtnbG9iYWwucj1yZXF1aXJlO2lmKHR5cGVvZiBtb2R1bGU9PT0..." - Obfuscation (osm-deobfuscator): unknown in index.js - recovered 2 urls, 4 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Dynamic Code Execution in index.js: "eval(code)" - Silent Process Execution in index.js: "stdio:"ignore"" - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES index.js