GCVE-110-OSM-2026-12292

On import, index.js calls initialize() which spawns a detached, stdio-suppressed, windowsHide `node loader.js` child (init.js) and records its PID. loader.js HTTPS-fetches JSON from https://api.npoint.io/641d37178a880b1e8b8f, base64-decodes the `code` field, and executes it via `new Function('require','__dirname','__filename','module','exports', decodedCode)(...)`, running arbitrary attacker-controlled JavaScript on the installer's host with full Node privileges and network access. The npoint.io endpoint is a mutable third-party JSON store whose contents can be changed at any time by whoever controls that resource, giving that party a persistent remote code-push channel into every installer. The package advertises itself as an image/runtime utility exposing `getProcessInfo`/`getRuntimeInfo`, but no such functions are exported; internal comments identify the code as an 'ID-10 Client Module' for 'device information collection and remote code execution' with 'AUTO-START ON IMPORT'. ENTRY index.js (main: index.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Payload Download from Paste Service in loader.js: "npoint.io" - Network Request in loader.js: "https.get(" - System Information Collection in loader.js: "process.platform" OBFUSCATION - Global Variable Shadowing in loader.js: "const module = {" - Dynamic Base64 Decoding in loader.js: "Buffer.from(code, "base64")" - Deobfuscation Failed in loader.js ADDITIONAL FINDINGS - Chai-Max Cryptocurrency Stealer in loader.js: "npoint.io/641d3717" - Silent Process Execution in init.js: "windowsHide: true" - Detached Child Process Payload in init.js: "spawn('node', [LOADER], { stdio: ['ignore', 'ignore', 'ignore'], windowsHide: tr..." - Dynamic Code Execution in loader.js: "new Function("require", "__dirname", "__filename", "module", "exports", decodedC..." - Shell Command Execution in loader.js: "require('child_process')" - Shell Command Variable Setup in loader.js: "win32") { const { spawnSync } = require('child_process'); const result = spawnSy..." (+1 more) PAYLOAD FILES loader.js