GCVE-110-OSM-2026-12451

This packge delivers a malicious XSS data-stealing payload. It fingerprints the victim/browser, grabs accessible browser/page data, captures the entire DOM, and sends the collected information to an xss.report collector endpoint. The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET to the protocol-relative URL //xss.report/c/k3rne111 whose response body is passed directly to eval(). Any require()/import of this package causes arbitrary attacker-controlled JavaScript from xss.report to execute in the consumer's Node process, with no pinning, no integrity check, and no relationship to the advertised functionality. The mismatch between the package's stated purpose (string utilities) and its actual contents (a remote-code loader) is a cover-story pattern. ENTRY payload.js (main: payload.js) Page loads ↓ Collect: ├─ Current URL ├─ document.cookie ├─ Referrer ├─ User-Agent ├─ Origin ├─ Browser language ├─ GPU/WebGL renderer ├─ localStorage ├─ sessionStorage └─ Entire page DOM ↓ JSON.stringify() ↓ HTTP POST → xss.report/c/k3rne111 ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern