GCVE-110-OSM-2026-13641

This package displays a fake Cloudflare check, contacts the attacker’s server for an encrypted destination, then redirects the victim there while forwarding tracking parameters. This lets the attacker secretly change where victims are sent—such as to phishing, scam, or malware pages—without embedding the final malicious URL in the package. ENTRY index.html (main: index.html) OBFUSCATION - String Array Obfuscation in index.html: "['yM9KEq','C2v0qxr0CMLIDq','DKPnsNO','E30Uy29UC3rYDq','BgfYzs5JB20VpW','ANnVBG',..." - Unicode Escape Obfuscation in index.html: "\x20\x0a\x20\x20\x20\x20\x20\x20\x20\x20" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern - Rapid Version Publishing - Campaign marker: Contagious Interview Malicious Dictionary in index.html: "_0x28aa" PAYLOAD FILES index.html