GCVE-110-OSM-2026-10748

bin/install/install.js appends a heavily obfuscated top-level IIFE (obfuscator.io-style rotated string array `_0x240a`/`_0x4963` with arithmetic index decoding) after the benign install() helper. The payload queries public Ethereum RPCs and etherscan.io for transactions from the hardcoded sender address 0xa322E5f3..., decodes the transaction `to` field as an IPv4 address, fetches an XOR-encrypted body from that host, and executes it via `eval(prefix+xor(body))` and a detached `spawn('node', ['-e',...], {detached:true}).unref()`. The package's main entry (bin/index.js) unconditionally requires./install/install, so the IIFE runs whenever the package is required or the CLI is invoked. The attacker controls the fetched payload by publishing new Ethereum transactions from the sender address; there is no version pinning, no signature check, and the destination host rotates on-chain. Decoded strings inside the string array include `eth_getBlockByNumber`, `etherscan.io`, `eval`, and `spawn`. Judge assessment: This is a clear attacker-controlled loader using a compromised-legitimate-package model: the CLI entrypoint unconditionally requires `bin/install/install`, and that file is heavily obfuscated (`obfuscator-io`, 1621 hex-variable hits, whitespace-hidden payload) with deobfuscated IOCs recovered. The OSV advisory is corroborated by the code indicators: hidden Ethereum RPC / etherscan-related strings, `global['r']=require` aliasing, and execution-stealth patterns (`{ silent: true }`) consistent with fetching and running a second-stage payload. The attacker model is a supply-chain operator publishing a loader that resolves a payload from on-chain transactions and executes it on the victim host; the package also POSTs to `https://api.harvestapp.com//v2/time_entries` with `HARVEST_ACCESS_TOKEN` and account IDs, which is exfiltration of user secrets rather than normal CLI behavior. The version burst with a 2026 publish date on an old package plus the deobfuscated hidden IOCs makes this a high-confidence malicious compromise, not a benign Harvest integration. ENTRY bin/index.js (bin: ./bin/index.js) DESTINATION - 2 exfil (custom-c2) - 8 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Network Request in bin/harvest/harvest-cli.js: "fetch('https:" OBFUSCATION - IOCs Found in Deobfuscated Code in bin/install/install.js - Whitespace-Padded Hidden Payload in bin/install/install.js: "; global" - Obfuscation: augmented proxied array function replacements in bin/install/install.js - Obfuscation (osm-deobfuscator): obfuscator-io in bin/install/install.js - String Array Obfuscation in bin/install/install.js: "['6f0121063e','Mozilla/5.','vsVto','BoIAd','GGFaB','ZFXMR','createInfl','cpUBI',..." - Unicode Escape Obfuscation in bin/install/install.js: "\u0068\u0074\u0074\u0070\u0073\u003A" - Decoded Unicode Escape Content in bin/install/install.js - Obfuscation patterns: hexVariables in bin/install/install.js (+1 more) ADDITIONAL FINDINGS - Global Require Alias in bin/install/install.js: "global['r']=require" - Silent Process Execution in bin/install/install.js: "{ silent: true" PAYLOAD FILES bin/install/install.js