GCVE-110-OSM-2026-11639

The package's postinstall script downloads a ZIP archive from a hardcoded Dropbox URL (https://www.dropbox.com/scl/fi/djz38wdi1wks9j1h57zuv/coeur.zip) to a hidden randomized temp path, extracts it using unzip/Expand-Archive, and executes any.exe found on Windows with detached, hidden-window flags. The install script short-circuits when NODE_ENV=production or CI is set, and stages the payload under os.tmpdir() with dot-prefixed random names (`.${Date.now()}.tmp`, `.data${Math.random()...}`) to evade sandbox/CI environments and casual discovery. The declared purpose (a text-transform utility) has no need for any binary download or execution. The fetched binary is unpinned, unverified, and delivered from an anonymous file-sharing host, yielding arbitrary code execution on developer Windows machines at `npm install` time. Judge assessment: This looks like a postinstall loader meant to deliver arbitrary code to developers at npm install time, especially on Windows machines. The entrypoint in `scripts/install.js` hardcodes a Dropbox ZIP URL, writes it to hidden temp paths, extracts it, and then launches any `.exe` found with `stdio: 'ignore'` and `windowsHide: true`, which is classic stealthy dropper behavior. The attacker model is a supply-chain compromise or malicious publisher targeting npm users by piggybacking on install hooks; the package name `text-transform-plus` has no legitimate need to download and run a binary. The OSV advisory is corroborated by the actual code and IOC `https://www.dropbox.com/scl/fi/djz38wdi1wks9j1h57zuv/coeur.zip?rlkey=cdp7afgbeiwk7kvko8qgzwemt&st=0hi6i7z2&dl=1`. ENTRY scripts/install.js (install-hook: node scripts/install.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 loader (loader) (values recorded in verified_iocs) EXFIL - System Information Collection in scripts/install.js: "process.platform" ADDITIONAL FINDINGS - Shell Command Execution in scripts/install.js: "require('child_process')" - Silent Process Execution in scripts/install.js: "stdio: 'ignore'" PAYLOAD FILES scripts/install.js