GCVE-110-OSM-2026-11400

Malicious npm package used as the encrypted-payload component of a multi-package supply-chain loader. Importing the package exposes an OpenSSL-formatted DES ciphertext. A transitive consumer decrypts it with a hard-coded password, after which the recovered JavaScript creates a hidden runtime directory, installs attacker-selected dependencies, establishes platform-specific execution, retrieves another JavaScript stage, and executes the server response with the Function constructor. The final server-supplied stage could not be recovered because the redirect destination timed out. Malicious payload found in: apps/docs/app/des.db The package entrypoint exports desKey from apps/docs/app/theta.js. That module synchronously reads des.db and exposes its Base64 text. The file is an OpenSSL salted ciphertext rather than a database or key. The consuming supersignaturenature bundle decrypts desKey with CryptoJS DES and the literal password "password", corresponding to DES-CBC with the legacy OpenSSL/CryptoJS MD5-based EVP_BytesToKey derivation. The decrypted version 1.0.16 stage creates ~/.vs_cache and writes main.js, package.json, and, on Windows, main.vbs. It builds a private npm project and installs axios, better-sqlite3 13.0.3, node-machine-id, and socket.io-client. On Windows it additionally installs @primno/dpapi and koffi 3.1.2. The loader searches for npm-cli.js relative to the active Node executable, prepends that executable directory to PATH, runs npm install inside ~/.vs_cache, and launches the generated main.js. Windows execution uses a generated WScript.Shell wrapper and hidden System32 wscript.exe; other platforms use detached Node execution. The generated main.js downloads JSON from a decoded secondary-stage location, reads response.data.sessions, supplies it to the Function constructor with require, module, exports, __dirname, and __filename, and invokes it. This enables arbitrary remote JavaScript execution with Node.js module and filesystem access. The short-link response was a redirect with an empty body. Two explicitly authorized bounded attempts to retrieve the direct redirect target timed out before receiving headers. The response-to-code path is confirmed, but the final sessions payload remains unavailable. Related chain: htps-provider@1.0.11 depends on supersignaturenature@^1.0.6; supersignaturenature@1.0.6 depends on manager-thedate@latest. The earlier htps-provider@1.0.10 used the incorrect dependency name supersignature, corrected in 1.0.11. manager-thedate has no install lifecycle hook; activation occurs when downstream code imports desKey and invokes the decryptor.