GCVE-110-OSM-2026-12446

This package is a credential-harvesting or data-exfiltration tool disguised as a Cloudflare Turnstile challenge page. The `index.html` entrypoint clones the Cloudflare 'Just a moment...' UI precisely to deceive victims, while embedding 89KB of heavily obfuscated JavaScript (obfuscator.io-style `_0x` variable names and a 300+ entry string array) that makes a `fetch()` call to an external URL resolving to `lare.com`. The publisher 'kla.opitz' is a textbook burner account: 6 days old, 5 packages all with random gibberish names, no descriptions or repositories. An npm package with an HTML file as its `main` entrypoint has no legitimate use case and exists solely to deliver this obfuscated payload. The attacker model is supply-chain delivery of a fake Cloudflare challenge to harvest tokens, credentials, or exfiltrate environment data to a custom C2. ENTRY index.html (main: index.html) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in index.html: "fetch('https:" OBFUSCATION - String Array Obfuscation in index.html: "['rwPjwvG','uM5htM8','vNzeAMG','AgLZihDLyNnPDa','igfUzcbtzwn1CG','CMv0DxjUicHMDq..." - Unicode Escape Obfuscation in index.html: "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.html