GCVE-110-OSM-2026-13853

The publisher 'noxza.exe' has a 75% malicious ratio across checked packages, with three confirmed malicious packages including 'noxleyss' rated high severity — this is a strong adversarial signal even when the current package's code-level findings are ambiguous. The package claims to be a Signal Protocol library (libsignal-node), which provides plausible cover for cryptographic base64 operations in src/session_record.js. Deobfuscation recovered 17 hidden strings from that file but yielded zero IOCs, meaning the payload (if any) is not obviously network-exfiltrating on static analysis — however, the presence of obfuscation in a supposed crypto utility library is itself suspicious. No exfil path was identified and no network, credential theft, or persistence findings were raised, so the code-level evidence alone does not confirm malicious behavior, but the publisher pattern is consistent with a campaign actor distributing multiple packages for supply-chain infiltration. ENTRY index.js (main: index.js) OBFUSCATION - Dynamic Base64 Decoding in src/session_record.js: "Buffer.from(k, 'base64')" - Strings Extracted from Deobfuscated Code in src/session_record.js ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Publisher Shows Burner-Account Pattern PAYLOAD FILES src/session_record.js