GCVE-110-OSM-2026-12405

This package is a sophisticated Magento/Stripe payment card skimmer using deliberate dual-entrypoint smuggling. The `main` UMD entry (`dist/my-lib.umd.js`) is a benign hello-world greet library, while the ESM `module` entrypoints (`src/index.js`, `src/env_load.js`) each execute `new Function(atob('<~180KB base64>'))`, decoding multi-layer obfuscated payloads at runtime. The decoded `qwdsc()` function harvests card number, expiry, CVV, billing address, email, and useragent into a JSON object and exfiltrates it via an invisible iframe to an attacker controlled URL. The attack mechanism injects a look-alike Stripe iframe (`__privateStripeFrame84331`) into pages where `window.location` contains 'checkout', hides the real Stripe iframe, and intercepts card input through the fake form — a textbook web-skimmer targeting Magento storefronts. The publisher account 'cheerleads' was created less than a day before publication with only two packages, the deobfuscator recovered 116 IOCs including `cdn.userationey.com` and `shipping.althemes.com` as exfiltration endpoints, and OSV advisory MAL-2026-16333 independently corroborates this exact behavior. ENTRY dist/my-lib.umd.js (main: dist/my-lib.umd.js) DESTINATION - 55 fetched-payload (deobfuscated) (values recorded in verified_iocs) OBFUSCATION - Decoded Base64 Content in src/env_load.js - Decoded Base64 Content in src/index.js - IOCs Found in Deobfuscated Code in src/crypto_custom.js - IOCs Found in Deobfuscated Code in src/env_load.js - IOCs Found in Deobfuscated Code in src/index.js - Dynamic Base64 Decoding in src/crypto_custom.js: "Function(atob" - Dynamic Base64 Decoding in src/env_load.js: "Function(atob" - Dynamic Base64 Decoding in src/index.js: "Function(atob" (+8 more) ADDITIONAL FINDINGS - Base64 Decoded Eval in src/crypto_custom.js: "new Function(atob" - Dynamic Code Execution in src/crypto_custom.js: "new Function(atob('dmFyIGYsZyxlLGksYixoLGMsZCxhOyhmdW5jdGlvbigpe3ZhciBsaUw9JycsV..." - Very New NPM Publisher Account PAYLOAD FILES src/env_load.js (+ src/index.js, src/crypto_custom.js)