GCVE-110-OSM-2026-13272

This package masquerades as a pino-style logging middleware (index.js exports a pino-compatible API and references pino internals) but bundles= a 4.37 MB heavily obfuscated lib/config.js that is required at import time. That file uses control-flow flattening (while(!![]){switch} — classic javascript-obfuscator output), 281k+ hex escape sequences, and calls execSync — a combination with no legitimate explanation in a config module of a logging library. The entrypoint comment explicitly notes it 'triggers a background process' yet the visible JS calls only next(), implying the actual payload executes inside the obfuscated require'd config. ENTRY index.js (main: index.js) OBFUSCATION - Hex Encoded Strings in lib/config.js: "'\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x7..." - Unicode Escape Obfuscation in lib/config.js: "\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74..." - Obfuscation patterns: controlFlowFlattening, hexHeavy in lib/config.js ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Dynamic Code Execution in lib/redaction.js: "exec(str)" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES lib/config.js (+ lib/redaction.js)