GCVE-110-OSM-2026-1358

Executes arbitrary attacker-controlled Node.js code at install time via postinstall hook. postinstall.js decodes a base64-obfuscated URL (https://jsonkeeper.com/b/XEKVH), fetches the payload via axios, and pipes it to a detached node subprocess via stdin — no payload file is written to disk. The detached process is unref'd to survive parent exit. package.json scripts.postinstall runs 'node postinstall.js'. The script base64-decodes DEV_API_KEY ('aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1hFS1ZI' → 'https://jsonkeeper.com/b/XEKVH'), GETs the URL via axios, extracts .data.cookie, spawns node with {detached:true, stdio:['pipe','ignore','ignore']}, writes the fetched payload string to child.stdin, closes stdin, and calls child.unref(). The payload never touches disk.