GCVE-110-OSM-2026-12849

The npm package dotenv-preflight@1.0.0 presents itself as a dotenv-related preflight utility but ships a single index.js whose contents are heavily obfuscated (hex-prefixed identifiers such as _0x351140, _0x3256d4, _0x3de8a6, _0x2a9875, _0x4d88e3 on line 1, consistent with javascript-obfuscator string-array output). Legitimate dotenv/env-preflight tooling is a few dozen lines of readable JavaScript; wrapping the entire module in a string-array obfuscator has no benign purpose for a package in this category and is the standard concealment technique used to hide credential-harvesting and network exfiltration behavior from casual review. The package name closely resembles the popular dotenv ecosystem, increasing the chance of accidental installation, and the obfuscated body would execute on require() by any consumer that adds this dependency. Semantic tracing of the obfuscated code triggered the provider's malware-output safety filter, which is characteristic of operational credential-theft or exfiltration payloads rather than routine business logic. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json LOOT - Cryptocurrency Wallet Theft in index.js: "seedPhrase" OBFUSCATION - Obfuscation: augmented proxied array function replacements in index.js - Obfuscation (osm-deobfuscator): obfuscator-io in index.js - Hex Encoded Strings in index.js: "'\x5c\x77\x2b\x20\x2a\x5c\x28\x5c\x29\x20\x2a\x7b\x5c\x77\x2b\x20\x2a'" - Unicode Escape Obfuscation in index.js: "\x5c\x77\x2b\x20\x2a\x5c\x28\x5c\x29\x20\x2a\x7b\x5c\x77\x2b\x20\x2a" - Obfuscation: obfuscator.io in index.js - Decoded Hex Escape Content in index.js (x2) - Strings Extracted from Deobfuscated Code in index.js - Obfuscation patterns: hexVariables in index.js PAYLOAD FILES index.js