GCVE-110-OSM-2026-11252

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. Judge assessment: This package matches a concealed-loader attacker model: the default entrypoint `index.js` contains encoded content that decodes into multiple hardcoded HTTPS endpoints on suspicious domains (`.top`, `.xyz`, `.vip`) plus repeated `token` fields, which is consistent with staged C2 or exfil infrastructure. The presence of `security holding package` and `npm-support` appears to be a camouflage label, but the recovered payload in `index.js` shows real URLs (`https://apihw1.whhzckj.top`, `https://api.slzxkj.xyz`, `https://apihw1.fengniaokq.vip`, `https://api.njslzx.top`) rather than benign placeholder data. The combination of encoded content, hidden IOCs, and a matching MAL advisory indicates this is not a false positive but a package intended to deliver or route traffic to attacker-controlled infrastructure. ENTRY index.js (default-index: index.js) OBFUSCATION - Decoded Base64 Content in index.js - recovered 4 urls, 3 domains from decoded/deobfuscated content PAYLOAD FILES index.js