GCVE-110-OSM-2026-13275

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. Judge assessment: This package was flagged by npm itself as a security holding (hasSecurityHolding: true, securityHoldingRecovered: true), meaning npm seized and replaced the original content due to confirmed malicious behavior — a strong institutional signal. OSV advisory MAL-2026-17627 corroborates full-compromise classification. The original package contained identical XOR-or-stream-cipher-encoded blobs (the base64 string 'aWp5c3loaWBTfRwpMxcPKwwf...' decoding to non-printable binary) replicated across five files (client, client.doc.1, json.txt, json.txt.1, json.txt.2), consistent with a loader distributing its payload across multiple carriers to survive partial extraction. The package has no entrypoint or exfil path resolved, no legitimate library purpose, and was brand-new at time of publication — the attacker model is a staged-payload dropper that hid its C2 or execution logic behind an encrypted blob, consistent with supply-chain compromise techniques. OBFUSCATION - Base64 Encoded Payload in client: ""aWp5c3loaWBTfRwpMxcPKwwfKjo4LB15ZHlrbmt5cnltbm5TPCEwLVN9Dws2FBs0HBF5ZHkZcX4PADU..." - Base64 Encoded Payload in client.doc.1: ""aWp5c3loaWBTfRwpMxcPKwwfKjo4LB15ZHlrbmt5cnltbm5TPCEwLVN9Dws2FBs0HBF5ZHkZcX4PADU..." - Base64 Encoded Payload in json.txt: ""aWp5c3loaWBTfRwpMxcPKwwfKjo4LB15ZHlrbmt5cnltbm5TPCEwLVN9Dws2FBs0HBF5ZHkZcX4PADU..." - Base64 Encoded Payload in json.txt.1: ""aWp5c3loaWBTfRwpMxcPKwwfKjo4LB15ZHlrbmt5cnltbm5TPCEwLVN9Dws2FBs0HBF5ZHkZcX4PADU..." - Base64 Encoded Payload in json.txt.2: ""aWp5c3loaWBTfRwpMxcPKwwfKjo4LB15ZHlrbmt5cnltbm5TPCEwLVN9Dws2FBs0HBF5ZHkZcX4PADU..." - Decoded Base64 Content in client (x14) - Decoded Base64 Content in client.doc.1 (x14) - Decoded Base64 Content in json.txt (x14) (+2 more) ADDITIONAL FINDINGS - Brand New Package PAYLOAD FILES client (+ client.doc.1, json.txt)