GCVE-110-OSM-2026-10762

Package published as `electron-sessions` advertises itself as generic 'Session utilities' but ships a single 1.18MB heavily obfuscated `dist/index.js` (javascript-obfuscator with rotating string-array of length 4399, control-flow flattening, self-defending wrapper, dead-code injection) as both `main` and `bin`. The bundle contains plaintext substrings `chrome`, `cookies`, `electron` alongside an import of the `@vercel/blob` upload SDK (declared runtime dependency `@vercel/blob: ^2.6.1`), whose primary API uploads arbitrary bytes to a Vercel Blob store held by whoever controls the `BLOB_READ_WRITE_TOKEN`. Package naming targets Electron/Chromium session artifacts (cookies, Local Storage/leveldb, Login Data), the README exposes only a one-line `new Sessions()` cover-story API with no documented upload endpoint or caller-configurable destination, and the upload SDK has no legitimate purpose in a generic session-utilities library. Any process that runs `npx electron-sessions` or `require('electron-sessions')` executes the obfuscated bundle against its own host, and collected session data is shipped to an author-controlled Vercel Blob endpoint. Judge assessment: This looks like a data-stealing Electron session grabber designed for the attacker model of package consumers running `require('electron-sessions')` or `npx electron-sessions`, where the bundle collects Chromium/Electron session artifacts and uploads them out of band. The entrypoint `dist/index.js` is a 1.18MB obfuscated payload with `hex variables`, `control flow flattening`, and `obfuscator.io` signatures, which is far beyond normal library minification and consistent with concealment of malicious logic. The OSV advisory’s claim is corroborated by the package shape: `bin` and `main` both point at the obfuscated bundle, and the code references `chrome`, `cookies`, `electron`, and `@vercel/blob`, which is a plausible exfil destination for stolen session data. I do not see a legitimate session-utilities explanation that would justify this level of obfuscation plus a blob-upload SDK in a tiny package with minimal metadata and no repository. ENTRY dist/index.js (bin: dist/index.js) OBFUSCATION - Obfuscation: augmented proxied array function replacements in dist/index.js - Hex Encoded Strings in dist/index.js: "'\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x7..." - Unicode Escape Obfuscation in dist/index.js: "\x73\x63\x72\x69\x70\x74\x50\x61\x74\x68" - Obfuscation: obfuscator.io in dist/index.js - Obfuscation patterns: hexVariables, controlFlowFlattening, hexHeavy in dist/index.js PAYLOAD FILES dist/index.js