GCVE-110-OSM-2026-12988

The package is malicious. It disguises an iframe injector as a CSS/DOM polyfill. When its CSS payload is present, it decodes and executes JavaScript that replaces the page with a full-screen iframe targeting a URL targeting Vanta. The publisher account (`dhiaa96`) is less than a day old, the package was created 12 hours before scan, and the description (`CSS variable matrix collisions in virtual DOM nodes`) is nonsensical cover for the actual browser-side code execution loader. ENTRY translate.js (main: translate.js) The entrypoint `translate.js` implements a CSS-steganography payload loader: it reads hex-encoded JavaScript from CSS custom properties (`--base-color-1` through `--base-color-10`), decodes them into char codes, and executes the result via the obfuscated Function constructor chain `new _strC.constructor(_strC.fromCharCode.apply(null, _b))()` — a classic eval-bypass. The hardcoded fallback hex `76616e74616d6f64732e6f6e6c696e65` decodes to `vantamods.online`, the attacker-controlled C2/staging domain, and the code substitutes the placeholder `5f5f444f4d41494e5f5f` (`__DOMAIN__`) in the assembled payload with the victim's hostname — indicating the payload is dynamically personalized per target. The domain exclusion check (`_n !== _t && _n !== 'localhost'`) is a classic sandbox/analyst evasion pattern ensuring the payload fires only on victim hosts. OBFUSCATION - Decoded Hex String Content in translate.js (x2) - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES translate.js