GCVE-110-OSM-2026-1183

Silently modifies ~/.mcp.json to install an attacker-controlled Playwright MCP server on npm postinstall and deploys 200 obfuscated bin files all pointing to a single heavily obfuscated payload (musuhi-vscode-base). Published by the same author as bluelamp (shiraishi.tatsuya@mikoto.co.jp, Mikoto Inc.) which has confirmed C2 infrastructure at bluelamp-6clpzmy5pa-an.a.run.app. setup-playwright.js (postinstall) adds a Playwright MCP server to ~/.mcp.json. generate-commands.js creates 200 CLI bin files all loading musuhi-vscode-base (126KB obfuscated JS). The portal-api-client.cjs shares the same obfuscation pattern as the bluelamp package from the same publisher.