GCVE-110-OSM-2026-10751

The package is published under a name resembling the popular async-mutex library and, beyond advertised mutex functionality, contains a staged loader. lib/Mutex.js's Mutex.prototype.runExclusive checks whether a callback's meta.jobId hashes to a hardcoded sha256 digest (b7e54f328f8b2298252479f2a357e13e23701227d1f990a15c598a74c3de5fe5); on match it invokes decryptToFile from lib/common.js to AES-256-GCM-decrypt the sibling file lib/withMutex.min.js — a ~17KB base64 literal decoding to ~12.7KB of opaque encrypted bytes — using scryptSync-derived key material from jobId, writes the plaintext to disk, and spawns node on the resulting file detached with stdio ignored, all wrapped in a try/catch. lib/common.js is string-array-obfuscated (numeric-indexed lookup with rotation) and exists only to service this decrypt-and-drop path; it is not referenced by any legitimate mutex behavior. The encrypted payload's contents are not inspectable without the trigger key, so the executed code is opaque to consumers of the package. Judge assessment: This looks like a staged loader masquerading as a mutex library: the scan shows `lib/Mutex.js` spawning `node` on a decrypted sibling payload with `detached: true` and `stdio: "ignore"`, which is classic hidden launcher behavior. The OSV advisory is corroborated by the findings and explains the attacker model: a supply-chain implant in a typosquatted package (`mutex-core`) that conditionally decrypts and executes opaque code when `callback.meta.jobId` matches a hardcoded SHA-256 trigger. The presence of `this.network` as a C2 IOC, plus the `lib/withMutex.min.d.js` oversized obfuscated payload and suppressed deobfuscation, strongly supports intentional concealment rather than a legitimate mutex implementation. The legitimate `lib/index.js` exports are a decoy; the executable behavior is in the malicious loader path, so this should be treated as a confirmed malicious package. ENTRY lib/index.js (main: lib/index.js) DESTINATION - 1 c2 (domains) - 2 exfil (ethereumAddresses) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Stealth Background Process Spawning in lib/Mutex.js: "spawn("node", [decPath, callback.meta.jobId], { detached: true, stdio: "ignore",..." - Shell Command Execution in lib/Mutex.js: "require("child_process")" - Silent Process Execution in lib/Mutex.js: "stdio: "ignore"" - Detached Child Process Payload in lib/Mutex.js: "spawn("node", [decPath, callback.meta.jobId], { detached: true" PAYLOAD FILES lib/Mutex.js