GCVE-110-OSM-2026-13484

package.json at line 41 declares the only runtime dependency `node-net-pool` as `https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz` — an off-registry HTTP source pointing at the mutable `main` branch of a GitHub account unrelated to the mfasolver publisher, with no commit pin and no integrity hash. `npm install mfasolver` fetches whatever bytes that URL returns at install time and runs any lifecycle scripts contained in the fetched archive. The dependency is additionally force-loaded on require: `lib/cache.js` top-level calls `module['require']('node-net-pool')` inside a try/catch, so importing mfasolver also executes the attacker-controllable code. Separately, `index.js` opens TLS connections to discord.com with `rejectUnauthorized: false`, disabling certificate validation on the package's own Discord traffic. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "node-net-pool": "https://github.com/trktgq0wbre1/node-net-poo..." - URL Dependency Fetch Failed in package.json EXFIL - Data Encoding for Exfiltration in lib/crypto.js: "Buffer.from(data).toString('base64')" - Data Encoding for Exfiltration in lib/http.js: "encodeURIComponent(k) + '=' + encodeURIComponent(v" - Data Encoding for Exfiltration in lib/totp.js: "encodeURIComponent(issuer || '')}:${encodeURIComponent(account)}?${qs" OBFUSCATION - Dynamic Base64 Decoding in lib/crypto.js: "Buffer.from(data, 'base64')" - Decoded Base64 Content in index.js - Decoded Base64 Content in lib/crypto.js - Decoded Base64 Content in [deobfuscated] lib/crypto.js - Base64 Encoded Payload in index.js: "'eyJicm93c2VyIjoiQ2hyb21lIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiQ2hyb21lIiwiY2xpZW50X2J..." - Strings Extracted from Deobfuscated Code in lib/crypto.js ADDITIONAL FINDINGS - Very New NPM Publisher Account PAYLOAD FILES lib/crypto.js