GCVE-110-OSM-2026-10738

Package x6842179305 ships a main entry (1.js) that invokes the `Function` constructor over a custom-encoded, keyed/XOR-decoded byte buffer, causing an opaque payload to execute whenever the module is required or imported. A sibling file (ui.js) contains a matching custom-alphabet decoder feeding another opaque byte stream. The runtime behavior of the decoded payload — including any network destinations, credential access, or filesystem writes — is not statically determinable because the code has no readable source form. The package name is a numeric burner-style identifier with no documented purpose, no README describing functionality, and no legitimate library shape (no exported API surface, no source tree). A Function()-constructor executor over a custom-encoded byte table on module load has no benign engineering rationale and matches the obfuscated-loader / dropper pattern used to hide install- or import-time payloads from static review. Judge assessment: This looks like an obfuscated loader/dropper intended to execute an attacker-controlled payload on import: the entrypoint `1.js` uses `Function(...)` over a custom-encoded byte buffer, and `ui.js` is a sibling obfuscated decoder with matching characteristics. The attacker model is code execution concealment plus possible downstream C2 or credential theft, and the package name `x6842179305` plus minimal metadata strongly fit a throwaway burner package used to evade review. The analyzer also recovered a plaintext C2 indicator, `https://duel.com` / `duel.com`, classified from a network call in `console.js`, which corroborates malicious intent beyond mere obfuscation. Heavy unicode/hex obfuscation in `1.js` and the skipped deobfuscation of a 740 KB blob further reinforce that the real behavior is intentionally hidden. ENTRY 1.js (main: 1.js) DESTINATION - 2 c2 (urls, domains) (values recorded in verified_iocs) OBFUSCATION - Obfuscation (osm-deobfuscator): unknown in ui.js - Obfuscation patterns: unicodeHeavy, hexHeavy in 1.js