GCVE-110-OSM-2026-1232

On require(), silently spawns a detached child process that fetches arbitrary Node.js from https://jsonkeeper.com/b/BADC6 via new Function.constructor('require', payload)(require), giving the stage-2 payload full access to the Node.js runtime. Part of the hello@jsonspack[.]com campaign. index.js calls spawn('node', ['./lib/caller.js'], { detached: true, stdio: 'ignore' }) on every require(). lib/const.js holds the base64-encoded C2 URL (https://jsonkeeper.com/b/BADC6) in a local 'const process' object that shadows Node.js's global process — making process.env.DEV_API_KEY appear as an environment variable lookup while the value is hardcoded. caller.js decodes the URL via atob() and executes response.data.cookie via new Function.constructor('require', s)(require). 5 retry attempts.