GCVE-110-OSM-2026-10753

lib/Mutex.js contains a hidden branch inside runExclusive() that, when a callback object carries a meta.jobId whose sha256 equals a hardcoded value (6cdda0ba143b3bee5949d3d45d2145c53c02abfe0e742465cdce2c0393e94d7f), invokes decryptToFile() from an obfuscated helper lib/common.js to AES-256-GCM-decrypt the shipped lib/plusMutex.min.js using the caller-supplied jobId as the key, then spawns the decrypted file via `node` as a detached, stdio-ignored, windowsHide child process. lib/common.js is a string-array + index-rotation obfuscated module wrapping scryptSync + createDecipheriv + writeFileSync; it is required only from this hidden branch. lib/plusMutex.min.js (16.9 KB, sha256 903169c2602ad15ba2dbc3c1e791bd26561958508d7d8a7ce35fc7d53c6212e1) is the AES-256-GCM ciphertext; sibling files lib/plusMutex.min.d.js (862 KB) and lib/tryAcquireMutex.min.d.js use a fabricated `.d.js` extension (real TypeScript declarations are `.d.ts`) to disguise executable/binary content as declaration artifacts. A mutex primitive has no functional need for encrypted-at-rest sibling blobs, an obfuscated GCM decryptor, or a hash-gated detached node spawn. The construction gives whoever holds the correct jobId — the decryption key — remote code execution on any consumer of Mutex.runExclusive that receives a crafted callback object, with the payload undecryptable without that key. Judge assessment: This looks like a deliberate hidden-loader designed for a controlled attacker model: a crafted `callback.meta.jobId` unlocks a branch in `lib/Mutex.js` that decrypts a shipped payload and launches it as a detached, hidden `node` process. The combination of `stealth-process-spawning`, `detached-child-process`, and `stdio: "ignore"` is not normal mutex behavior, and the package also ships obfuscated sibling payloads like `lib/plusMutex.min.d.js` that are too large for deobfuscation. The OSV advisory’s description is strongly corroborated by the analyzer evidence, and the hardcoded network IOC `this.network` plus the fabricated `*.min.d.js` artifact shape fit a covert malware dropper rather than a legitimate concurrency library. ENTRY lib/index.js (main: lib/index.js) DESTINATION - 1 c2 (domains) - 2 exfil (ethereumAddresses) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Stealth Background Process Spawning in lib/Mutex.js: "spawn("node", [decPath, callback.meta.jobId], { detached: true, stdio: "ignore",..." - Shell Command Execution in lib/Mutex.js: "require("child_process")" - Silent Process Execution in lib/Mutex.js: "stdio: "ignore"" - Detached Child Process Payload in lib/Mutex.js: "spawn("node", [decPath, callback.meta.jobId], { detached: true" PAYLOAD FILES lib/Mutex.js