GCVE-110-OSM-2026-12676

On require, index.js invokes initializeDaemon() at top level, which uses spawn('node', [lib/check-items.js], { detached: true, stdio: 'ignore' }) followed by child.unref() to launch a persistent background process independent of the parent. The daemon HTTP-GETs a JSON payload from the hardcoded endpoint https://game.spawnrealm.com/api/item-realtime?key=abcdef123456 and passes payload.code to `new Function('require', 'module', payload.code)`, executing server-supplied JavaScript inside the installer's Node process with full `require` access. An RSA signature check is performed against a public key bundled in the package (crypto-config.js), so the author controls both the signing key and the verifier and the check provides no independent integrity guarantee. Anyone controlling game.spawnrealm.com — including via DNS or TLS — can run arbitrary code as the installing user for the lifetime of the host process. The package is advertised as a validator library, and this remote-code-loader behavior is undisclosed and unrelated to the stated purpose. ENTRY index.js (main: index.js) OBFUSCATION - Obfuscation (osm-deobfuscator): unknown in SAMPLE_PAYLOADJS.js - Strings Extracted from Deobfuscated Code in SAMPLE_PAYLOADJS.js - Obfuscation patterns: hexVariables in SAMPLE_PAYLOADJS.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn('node', [daemonScript], { detached: true, stdio: 'ignore' }" - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn('node', [daemonScript], { detached: true" - Brand New Package - Very New NPM Publisher Account (+1 more) PAYLOAD FILES index.js (+ lib/init.js)