GCVE-110-OSM-2026-10761

package.json declares `"postinstall": "sudo node install.js"`, escalating to root on `npm install`. install.js is heavily obfuscated (obfuscator.io: rotated 140-entry string array `a0_0xdc68`, hex-encoded property lookups, control-flow flattening, self-defending stubs) so the executed behavior is deliberately hidden from installers. index.js is similarly obfuscated (rotated 164-entry string array `a0_0x53d8`, runtime base64 decoding via `Buffer[...](ertrf,...).toString()`), declares `js-virtualizer` as a runtime dependency, and reads `process.env.INVOCATION_ID` into an `isRunningAsService` flag — an environment variable set only when a process is launched by systemd. The package also depends on `node-linux`, a library that registers /etc/init.d or systemd unit files. The combination — root-level lifecycle hook, opaque payload, systemd-context branch, and a daemon-installer dependency — is the shape of an obfuscated root-persistent daemon dropper executed at install time on the installer's host. Judge assessment: This looks like an obfuscated install-time dropper intended to run with elevated privileges on the installer’s machine, which is a classic supply-chain attacker model. The package.json postinstall hook is literally `sudo node install.js`, and both `install.js` and `index.js` are packed with obfuscator.io signatures, hex-variable walls, and self-defending/proxied array patterns that deliberately hide the executed behavior. The OSV advisory’s claim that the payload is a root-level lifecycle hook combined with systemd/daemon-install logic is consistent with the evidence here, and the hidden code is being executed at install time rather than as a normal library function. Even without recovered exfil IOCs, the combination of privileged install hook plus heavy obfuscation is sufficient to treat this as malicious. ENTRY install.js (install-hook: sudo node install.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Obfuscation: augmented proxied array function replacements in index.js - Obfuscation: augmented proxied array function replacements in install.js - Obfuscation (osm-deobfuscator): obfuscator-io in index.js - Obfuscation (osm-deobfuscator): obfuscator-io in install.js - Hex Encoded Strings in index.js: "'\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x7..." - Unicode Escape Obfuscation in index.js: "\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74..." - Obfuscation: obfuscator.io in index.js - Hex Encoded Strings in install.js: "'\x6d\x5a\x69\x58\x6e\x64\x6a\x6c\x74\x4b\x66\x6e\x7a\x78\x71'" (+8 more) PAYLOAD FILES index.js (+ install.js)