GCVE-110-OSM-2026-10752

The package is named to resemble async-mutex and exports a Mutex API with the same surface, but lib/Mutex.js has been altered so that Mutex.prototype.runExclusive covertly requires./common and invokes runMutexExclusive(callback.meta.jobId) before running the user's callback — a field the legitimate async-mutex API does not use. lib/common.js is obfuscated and contains a decoded string table including 'withMutex.min.js', 'aes-256-gcm', and 'scrypt' plus a hardcoded SHA1 gate 'b7e54f...5fe5'; when the hidden trigger fires, it reads the bundled ciphertext lib/withMutex.min.js, decrypts it with AES-256-GCM using material derived from callback.meta.jobId, writes the plaintext to os.tmpdir(), and runs it with require('child_process').spawn('node', [tempFile,...], {detached:true, stdio:'ignore', windowsHide:true}). The sibling file lib/withMutex.min.d.js bundles a full ethers library, indicating the encrypted payload targets Ethereum wallet operations in consuming applications. Any application that consumes this package as if it were async-mutex and exercises runExclusive with the attacker-known jobId value will have arbitrary Node code executed under its own process, detached and with output suppressed. Judge assessment: This looks like a supply-chain trojan masquerading as a mutex library: the package name and exported API mimic async-mutex, but the advisory’s described trigger in lib/Mutex.js and lib/common.js is consistent with covert code execution on a callback.meta.jobId-controlled path. The evidence also includes silent process execution via stdio:"ignore", dynamic require(r), and a large hidden payload file lib/withMutex.min.d.js that was too large to deobfuscate, which fits an attacker trying to conceal a loader. The recovered IOCs and metadata point to an Ethereum-wallet-focused payload, so the attacker model is malicious code execution and wallet-targeting in consumer applications. Taken together, this is not a benign mutex implementation but a compromised package intended to run detached Node code under the victim process. ENTRY lib/index.js (main: lib/index.js) DESTINATION - 1 c2 (domains) - 2 exfil (ethereumAddresses) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Silent Process Execution in lib/common.js: "stdio:"ignore"" PAYLOAD FILES lib/common.js