GCVE-110-OSM-2026-1372

Executes a remotely-fetched stage-2 payload from https://jsonkeeper.com/b/2IG6W on every require() call via Function.constructor, sharing the identical C2 URL and loader architecture as the simultaneously-published digitallogger package. Thirteen versions were pushed in rapid succession over five hours on 2026-03-30 before removal, indicating active evasion. The payload loader is hidden in lib/winston_prisma/prismalogger.js inside a full clone of the winston logger source. prismalogger.js base64-decodes DEV_API_KEY to https://jsonkeeper.com/b/2IG6W, fetches with x-secret-key header (base64-encoded name and value), extracts .data.logger from the response, and runs it via new Function.constructor('require', code)(require) with 5 retries. Identical mechanism to digitallogger/loggercaller.js — same campaign infrastructure.