GCVE-110-OSM-2026-11593

This package is a DPRK/Lazarus typosquat of the legitimate tailwindcss-forms package, with two distinct campaign markers confirmed in deobfuscated src/index.js: 'q4FZkxX{!h,Sr3=@' (nullreceiver campaign) and global['_V'] (PolinRider campaign), both attributed to Lazarus Group. The obfuscated payload (obfuscator.io, 1686 hex-encoded variable names, proxied array-function replacement) hides Ethereum blockchain interaction code referencing eth_getTransactionCount, eth_getBlockNumber, Ethereum RPC endpoints (h.drpc.org), and the attacker-controlled wallet address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a classified as an exfil role — consistent with a crypto-drainer targeting developer wallets. The package uses global['r']=require to conceal module loading, and the entrypoint file bloats to 41KB versus the ~8KB legitimate source, with the malicious obfuscated loader appended after what appears to be copied legitimate plugin code. The publisher account (davidchen1111@proton.me) was created the same day as publication with a single package, and the repository field points to the legitimate tailwindlabs repo to add credibility. ENTRY src/index.js (main: src/index.js) DESTINATION - 1 exfil (ethereumAddresses) - 8 fetched-payload (deobfuscated) (values recorded in verified_iocs) OBFUSCATION - IOCs Found in Deobfuscated Code in src/index.js - Obfuscation: augmented proxied array function replacements in src/index.js - Obfuscation (osm-deobfuscator): obfuscator-io in src/index.js - String Array Obfuscation in src/index.js: "['FwRkP','ktBkf','createInfl','SOHhg','Agent','xeAJy','GUDGc','kmoyl','BUGBq','Q..." - Obfuscation patterns: hexVariables in src/index.js - recovered 2 ipv4, 2 urls, 8 domains, 1 ethereumAddresses, 8 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Global Require Alias in src/index.js: "global['r']=require" - Campaign marker: nullreceiver in [deobfuscated] src/index.js: "q4FZkxX{!h,Sr3=@" - Campaign marker: PolinRider in [deobfuscated] src/index.js: "global['_V']" - Dynamic Code Execution in scripts/release-channel.js: "exec(version)" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES src/index.js