GCVE-110-OSM-2026-1185

Downloads and executes a stage-2 payload from attacker-controlled domain isillegion.com/api/ip-check-encrypted/3aeb34a37 via a detached background process spawned on postinstall. The downloaded code is executed via new Function.constructor('require', response)(require), granting full Node.js access to the payload. postinstall runs index.js which spawns a detached Node.js child process (lib/initializeCaller.js) that decodes base64 URL 'https://www.isillegion.com/api/ip-check-encrypted/3aeb34a37' and POSTs to it via axios. The response body is executed as: new Function.constructor('require', response)(require). Retries up to 5 times on failure. Package masquerades as the 'pino' logging library.