GCVE-110-OSM-2026-1368

Executes an encrypted Function()-constructor payload at install time via a postinstall hook, using a custom string-array rotation cipher to conceal the embedded code from static analysis. The package explicitly declares axios, form-data, child_process, and os as production dependencies — a standard HTTP data-exfiltration toolkit — indicating the decrypted payload POSTs collected data to a remote C2. Part of a coordinated campaign distributing identical test.js payloads (SHA256: 6a9610c45b) across four packages published under separate throwaway Gmail accounts. package.json postinstall runs 'node test.js'. test.js is a 26.6 KB file containing a single Function() constructor call: Function('kqtIJj5', '<encrypted 26KB body>')({...}). The body is encoded with a custom string-array rotation cipher (LZW-like with shuffled 91-character alphabet). Production deps axios ^1.7.0 + form-data ^4.0.0 are the HTTP exfil mechanism; child_process ^1.0.2 enables command execution; os ^0.1.2 provides system fingerprinting. C2 URL is encrypted inside the payload and cannot be recovered statically.