GCVE-110-OSM-2026-10713

The package advertises itself as an Express session middleware but on module load unconditionally invokes an initPlugin() routine in index.js that performs an HTTPS fetch to https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92, parses the response, extracts the record.cerookie field, and passes the resulting string to Function.constructor with require bound as an argument, executing attacker-controlled JavaScript in the installer's Node.js process. The remote document is mutable and controlled by whoever owns that jsonbin bin, so the code executed on any host that requires this module can be changed at any time. The file is prefaced with a '/*! normalize-path (ES6 safe version) */' header and ships an unused normalizePath helper alongside the loader, presenting a cover story unrelated to the actual behavior. Judge assessment: This is a classic remote-code-loader for a supply-chain attacker: `index.js` unconditionally calls `initPlugin()` on module load, fetches mutable content from `https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92`, and feeds `record.cerookie` into `Function.constructor` with `require` bound, which executes attacker-controlled JavaScript in the victim's Node.js process. The `paste-download` finding and the IOC classification both identify `api.jsonbin.io` as exfil/custom-C2, and the fake `/*! normalize-path (ES6 safe version) */` wrapper is a cover story unrelated to the loader. The attacker model is a package publisher using a benign-looking npm name to deliver a mutable remote payload that can be changed after publication, which is highly consistent with malware behavior. The OSV MAL advisory is corroborated by the actual entrypoint code, not just metadata. ENTRY index.js (main: index.js) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Payload Download from Paste Service in index.js: "jsonbin.io" PAYLOAD FILES index.js