GCVE-110-OSM-2026-1360

Executes attacker-controlled second-stage Node.js payload on every require() by fetching from https://api.npoint.io/545d3d0c167b8dde920f and invoking the response via `new Function.constructor('require', response)`. The C2 URL is hardcoded as a base64-encoded constant in lib/const.js, ensuring unconditional execution regardless of environment variables. lib/initializeCaller.js decodes DEV_API_KEY (base64 constant 'aHR0cHM6Ly9hcGkubnBvaW50LmlvLzU0NWQzZDBjMTY3YjhkZGU5MjBm') via atob(), performs an axios GET to https://api.npoint.io/545d3d0c167b8dde920f with a custom header (apiHeaderKey/apiHeaderValue from lib/const.js), extracts the .cookie field from the JSON response, constructs a Function via `new Function.constructor('require', response)`, and calls it with the host process's require — granting the stage-2 payload full Node.js module access.