GCVE-110-OSM-2026-1224

On require(), silently spawns a detached child process that fetches arbitrary Node.js from https://jsonkeeper[.]com/b/XRGF3 (9/94 VT: Kaspersky, Sophos, BitDefender) via new Function.constructor('require', payload)(require), giving the stage-2 payload full access to the Node.js runtime. Part of the hello@jsonspack[.]com campaign; sibling of accepted chai-beta (XRGF3 cluster). index.js spawns lib/caller.js detached. caller.js sets const src = 'https://jsonkeeper[.]com/b/XRGF3' as a plaintext string literal (C2 URL directly visible in source). Fetches response.data.cookie and evaluates via new Function.constructor('require', s)(require). 5 retry attempts. No postinstall hook.