GCVE-110-OSM-2026-12142

This package is a typosquat of the legitimate tailwindcss-forms library, masquerading with a plausible name while embedding heavily obfuscated malware in src/index.js. The deobfuscated content contains two confirmed DPRK/Lazarus campaign markers: the nullreceiver marker 'q4FZkxX{!h,Sr3=@' and the PolinRider marker 'global["_V"]', both well-known attribution signatures for North Korean supply-chain attacks. The malware's attacker model is crypto-draining and command exfiltration: the code establishes Ethereum RPC connections (h.drpc.org, public.blastapi.io, eth-mainnet endpoints), queries transaction history for a hardcoded Ethereum address and communicates with fetched-payload domains recovered from deobfuscation (ut.com, stapi.io, jx.tx.to). The global['r']=require alias and 1539 hex-variable obfuscation patterns are canonical Lazarus/PolinRider infrastructure; this is not ambiguous. ENTRY src/index.js (main: src/index.js) DESTINATION - 8 fetched-payload (deobfuscated) (values recorded in verified_iocs) OBFUSCATION - IOCs Found in Deobfuscated Code in src/index.js - Obfuscation: augmented proxied array function replacements in src/index.js - Obfuscation (osm-deobfuscator): NiceGUI Multi-layer Obfuscation in src/index.js - String Array Obfuscation in src/index.js: "['eth_blockN','_process',':443/0x/cl','olKrM','BtmBu','LUUcK','h.blocksco','http..." - Obfuscation patterns: hexVariables in src/index.js - recovered 1 ipv4, 2 urls, 8 domains, 8 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Global Require Alias in src/index.js: "global['r']=require" - Dynamic Code Execution in scripts/release-channel.js: "exec(version)" PAYLOAD FILES src/index.js