GCVE-110-OSM-2026-11640

The package declares a postinstall script (scripts/install.js) that on npm install downloads a ZIP archive from https://www.dropbox.com/scl/fi/djz38wdi1wks9j1h57zuv/coeur.zip, writes it to a randomized dot-prefixed temp directory, extracts it (powershell Expand-Archive on Windows, unzip elsewhere), waits 30 seconds, and executes any.exe/.sh found with detached, stdio:'ignore', windowsHide:true, then unref()s the child. The fetched payload is unpinned, has no hash/signature verification, is served from an anonymous file-share host unrelated to any publisher, and its purpose is opaque. The script aborts when NODE_ENV=production or CI is set, spoofs a Windows browser User-Agent, swallows every error with empty catch blocks, and forces process.exitCode=0 so install always reports success. Package identity is inconsistent: package.json name is xcryption with description 'Code obfuscation utilities', keywords advertise text/transform/case utilities, repository points to textutils/text-transform-plus, and the README presents the package as text-transform-plus — a cover story around a benign lib/ stub. Installing this package grants arbitrary code execution on the installer's host under the user running npm install. Judge assessment: This is an install-time downloader/dropper consistent with a supply-chain attacker model: `package.json` runs `node scripts/install.js` on postinstall, and that script fetches an unpinned ZIP from Dropbox, extracts it, then executes any `.exe` or `.sh` it finds. The code also posts to a plaintext Discord webhook (`discord.com/api/webhooks/...`) with step markers like `[1] Plugin Triggered` and `[2] Download Success`, which is classic exfiltration/command-and-control telemetry. The use of `stdio: 'ignore'`, `windowsHide: true`, empty catches, and `process.exitCode = 0` shows deliberate stealth and failure suppression, not a legitimate build helper. The metadata mismatch between the `xcryption` name, the `textutils/text-transform-plus` repository, and the brand-new publisher account further supports a malicious package masquerading as a benign utility. ENTRY scripts/install.js (install-hook: node scripts/install.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (discord-webhook) - 1 loader (loader) (values recorded in verified_iocs) EXFIL - Webhook Data Exfiltration in scripts/install.js: "discord.com/api/webhooks/1542235719144177775/CoEhwm9HMMnATf7glxsBBHhJAkhMoHKW80Q..." - Network Request in scripts/install.js: "https.request(" - System Information Collection in scripts/install.js: "process.platform" ADDITIONAL FINDINGS - Shell Command Execution in scripts/install.js: "require('child_process')" - Silent Process Execution in scripts/install.js: "stdio: 'ignore'" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES scripts/install.js