GCVE-110-OSM-2026-10747

dist/index.js appends a heavily obfuscated obfuscator.io-style payload (string array _0x240a of length 303, decoder _0x4963, string-array rotation) after the clean TypeScript-compiled validation code. None of this obfuscated code is declared in dist/index.d.ts and it executes at top level on `import '@wizloft/harness-validation'`. Decoded string fragments include Ethereum RPC / block-explorer hostnames (`h.drpc.org`, `pc.io/eth`, `stapi.io`), a hardcoded attacker Ethereum address (`0xa322E5f3...`), Etherscan-style query parameters (`?module=account`, `filterby=from`), a spoofed browser User-Agent, and `application/json` / `content-encoding` request framing. The payload queries the block explorer for transactions from the hardcoded wallet, extracts a URL/payload from the transaction data, then fetches and executes the resolved content — a blockchain-based dead-drop that lets the publisher rotate the delivered code by posting a new transaction from that wallet, giving them a persistent mutable remote-code channel against every process that imports the library. Sibling packages in the @wizloft/* namespace (@wizloft/harness-evidence, @wizloft/harness-kernel) are declared dependencies at matching alpha versions and exhibit the same trojanized-library shape. Judge assessment: This package fits a trojanized library attacker model: a seemingly legitimate validation module whose imported entrypoint `dist/index.js` is being used as a carrier for hidden payload behavior. The OSV advisory describes an obfuscated top-level payload that queries Ethereum/block-explorer hosts, resolves a mutable dead-drop from transactions, and then fetches and executes remote content; that is a persistent remote-code channel, not normal validation logic. Even though the visible TypeScript-compiled validation code is clean, the described obfuscated append-only payload and cross-package namespace pattern in `@wizloft/*` are consistent with a compromised publish or intentionally malicious maintainer release. The metadata is also weakly suspicious (`new-package-week`, only two versions), but the decisive evidence is the claimed top-level import-time code execution and remote payload retrieval. ENTRY dist/index.js (default-index: index.js)