GCVE-110-OSM-2026-10745

dist/index.js contains an obfuscated top-level async IIFE that executes on import. It queries Ethereum JSON-RPC endpoints (eth.drpc.org, eth.publicnode.com, ethereum-rpc.publicnode.com, and an Etherscan-like API) for the most recent transaction from a hardcoded marker address (0xa322E5f39aDC2490Ef6f0121063e358050D311D3080e), parses the transaction's `to` field into two IPv4 addresses, HTTP-fetches XOR-encrypted payloads from `http://<ip>/0x/ls` and `http://<ip>:443/0x/cl`, XOR-decrypts them, then executes the resulting JavaScript via `eval(...)` and a detached `spawn('node', ['-e', <decrypted>], {detached:true})`. The entire loader is packed with obfuscator.io-style transforms (hex `_0x` identifiers, rotating string array `_0x240a`, control-flow flattening) that conceal the network-fetch-and-exec chain behind benign-looking exports. On-chain C2 makes the exfil/RCE destination mutable and takedown-resistant; the payload contents are opaque and attacker-controlled. Judge assessment: This looks like a compromised npm package used as a loader by an attacker model consistent with the MAL-2026-14287 advisory: an obfuscated top-level async IIFE runs on import, pulls Ethereum JSON-RPC data, derives mutable C2 IPs from a hardcoded marker address, fetches XOR-encrypted payloads, and executes them with `eval(...)` and detached `spawn('node', ['-e', ...])`. The static findings also flag `startup-persistence` in `dist/runtime.js` via `.profile`, which is consistent with a persistence attempt rather than normal library behavior. The package is newly created, has only two versions, and the entrypoint exports from `dist/index.js` hide execution behind harmless-looking API surface, a pattern commonly seen in supply-chain malware targeting npm consumers. ENTRY dist/index.js (default-index: index.js) PERSISTENCE - Startup Persistence in dist/runtime.js: ".profile" PAYLOAD FILES dist/runtime.js