GCVE-110-OSM-2026-10712

On any require()/import of mcq-session, the main module runs a top-level async IIFE that reads a file at../../../../public/logo.ico (a path escaping the package root into a host application's public assets), DES-decrypts the bytes with a hardcoded password 'bf497c0b9cee' using multiple CryptoJS decode formats, and pipes the decrypted plaintext into a detached, unref'd 'node' subprocess via stdin. The decrypted content is treated as executable JavaScript with no signature check, integrity verification, or user gate. The loader is disguised behind cover-story identifiers ('readLogoIco', 'ThetaSDK initialization'). The symmetric key ships alongside the loader, so the encryption serves only to defeat static inspection of the staged payload. The out-of-package path indicates the payload is dropped separately alongside a host application, making the on-disk blob attacker-controlled from the installer's perspective. Judge assessment: This looks like a staged loader for a host-application compromise: the package entrypoint is a normal export surface, but the advisory describes a top-level async IIFE that reads `../../../../public/logo.ico`, decrypts it with hardcoded key material, and feeds the result into a detached `node` subprocess. The `detached-child-process` finding in `src/api/session-api.js` matches that stealthy execution pattern, and the `post-method-exfiltration` finding in `src/transports/http.js` shows JSON `body: JSON.stringify(env...)`, consistent with environment collection and outbound posting. The attacker model is a supply-chain implant aimed at developers or build environments importing `mcq-session`, with the malicious payload hidden outside the package root to evade inspection. The minimal metadata adds some burner-packaging signal, but the decisive evidence is the loader-plus-detached-execution chain corroborated by MAL-2026-14347. ENTRY src/index.js (main: ./src/index.js) ADDITIONAL FINDINGS - Detached Child Process Payload in src/api/session-api.js: "spawn('node', [], { detached: true" PAYLOAD FILES src/transports/http.js (+ src/api/session-api.js)