GCVE-110-OSM-2026-10744

dist/index.js (the package's declared main) contains a heavily obfuscated obfuscator.io-style IIFE appended after the legitimate context-service code. On import, the payload stashes `global.r = require` and `global.m = module`, then issues HTTPS requests to an Ethereum public RPC endpoint (h.drpc.org) and a block-explorer account API to read state from contract 0xa322E5f3..., using that state to resolve a next-stage URL that is fetched and executed in-process. The obfuscated string array (~303 entries via a rotated decoder) hides `drpc.org`, `?module=ac`, `POST`, `application/json`, `Mozilla/5.`, and the contract address. This is the EtherHiding loader pattern: attacker-controlled contract state serves as a mutable pointer to arbitrary code executed in the installer/consumer process at require time. Behavior does not match the package's advertised purpose of a small typed capability contract. Judge assessment: The visible `dist/index.js` content is a normal typed context-service implementation, and the static score is clean, so the core package logic itself does not show obvious malware. However, the package also has an OSV malware advisory (`MAL-2026-14286`) describing an appended obfuscated loader in the declared main that would use `require`/`module` globals, query `h.drpc.org`, and execute a next-stage payload via the EtherHiding pattern. Because the provided entrypoint content does not include that payload and there are no recovered IOCs here, I cannot confirm the advisory, but the combination of a very new package and a malware advisory makes it suspicious enough for manual review. The attacker model, if the advisory is accurate, would be a compromised publisher or supply-chain adversary using a consumer import path to fetch and run remote code at require time. ENTRY dist/index.js (default-index: index.js)