GCVE-110-OSM-2026-12848

contoso-login-sim-loader@1.0.1 is a browser-based credential phishing loader. It injects an obfuscated login page, captures email/password attempts, fingerprints visitors, and exfiltrates data through a Cloudflare Worker that forwards it to Telegram. No local persistence or native subprocess execution was found. Package ships a single ~138 KB browser script whose entire body is an RC4-encrypted base64 blob decoded at runtime by an inline RC4 routine (`_zc`) with a DJB2 helper (`_zh`) and a key reconstructed by XORing a numeric array with 1410^714. Before decryption the script performs anti-analysis guards: a devtools-size heuristic (`if(_gz>160||_gp>160)return;`) that aborts execution when developer tools are open, and a block that overwrites `console.log/info/warn/debug/error` to no-ops to suppress runtime tracing. The package name `contoso-login-sim-loader` self-describes as a 'login sim(ulator) loader' while the published description reframes it as a generic 'Client-side asset loader that renders a self-contained UI component when included via a script tag.' The tarball ships no source, no exports, no dependencies, and no documentation - only the opaque encrypted payload. Any site that follows the include-via-script-tag guidance embeds attacker-controlled JavaScript, decrypted only in end-user browsers, into its own pages; the concealed payload cannot be audited without executing it, and the name plus cover-story description are consistent with a fake-login/credential-harvest overlay served to that site's visitors. ENTRY obfuscated_loader.js (main: obfuscated_loader.js) OBFUSCATION - Dynamic Base64 Decoding in obfuscated_loader.js: "atob(_c)" - Base64 Encoded Payload in obfuscated_loader.js: "'4rd2jxvm4+GaXScMr0Q70+dHHv+pP49JNVCApHFHDD4sBP6JGAEOuiaK7NAyz+oLuSYUXtKoi5ihD08..." - Obfuscation (osm-deobfuscator): unknown in obfuscated_loader.js - Strings Extracted from Deobfuscated Code in obfuscated_loader.js ADDITIONAL FINDINGS - XOR-Encoded String Arrays in obfuscated_loader.js: "var _q=[1809,1915,1828,1854,1795,1835,1793,1904,1839,1823,1916,1848,1912,1914,18..." PAYLOAD FILES obfuscated_loader.js