GCVE-110-OSM-2026-12114

This package implements a classic staged remote-code-execution attack consistent with the DPRK/Lazarus Contagious Interview (chai-max) campaign. The entrypoint (index.js) auto-initializes on import, spawning a detached, hidden child process via init.js. loader.js then fetches base64-encoded payload from the npoint.io C2 URL (https://api.npoint.io/24c25d5f5fcbb0992a4f) and executes it via `new Function("require", "__dirname", "__filename", "module", "exports", decodedCode)` — a textbook dynamic loader pattern. The module also monkey-patches `Module.prototype.require` to intercept child_process calls and enforce `windowsHide: true` for cross-platform stealth, demonstrating deliberate evasion engineering. Publisher account 'engin5' is less than a day old with a single package, and the npoint.io endpoint matches known chai-max C2 infrastructure by signature. ENTRY index.js (main: index.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Payload Download from Paste Service in loader.js: "npoint.io" - Network Request in loader.js: "https.get(" - System Information Collection in loader.js: "process.platform" OBFUSCATION - Global Variable Shadowing in loader.js: "const module = {" - Dynamic Base64 Decoding in loader.js: "Buffer.from(code, "base64")" - Deobfuscation Failed in loader.js ADDITIONAL FINDINGS - Chai-Max Cryptocurrency Stealer in loader.js: "npoint.io/24c25d5f" - Silent Process Execution in init.js: "windowsHide: true" - Detached Child Process Payload in init.js: "spawn('node', [LOADER], { stdio: ['ignore', 'ignore', 'ignore'], windowsHide: tr..." - Dynamic Code Execution in loader.js: "new Function("require", "__dirname", "__filename", "module", "exports", decodedC..." - Shell Command Execution in loader.js: "require('child_process')" - Shell Command Variable Setup in loader.js: "win32") { const { spawnSync } = require('child_process'); const result = spawnSy..." (+3 more) PAYLOAD FILES loader.js