GCVE-110-OSM-2026-12523

punypump ships a console-browserify-lookalike shim (index.js) that additionally requires library.js, which auto-executes initializeService() at module load. library.js fetches an encrypted blob from a base64-obfuscated URL that decodes to https://www.jsonkeeper.com/b/V6NBX (a public JSON-paste service used as a mutable payload host), AES-256-CBC decrypts the response with a hardcoded key/salt, and passes the plaintext to eval(). The endpoint URL and associated headers are stored in config.js as base64 strings decoded at runtime. Any process that requires punypump executes whatever code the paste currently serves. README and badges are copied from console-browserify, while the package is named punypump and contains an added remote-code loader that console-browserify does not. OBFUSCATION - Decoded Base64 Content in config.js - Dynamic Base64 Decoding in library.js: "Buffer.from(encodedValue, 'base64')" - Deobfuscation Failed in library.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES config.js