GCVE-110-OSM-2026-1389

Executes an encrypted Function()-constructor payload at install time via a postinstall hook, using a custom string-array rotation cipher to conceal the embedded code from static analysis. The package explicitly declares axios, form-data, child_process, and os as production dependencies — a standard HTTP data-exfiltration toolkit — indicating the decrypted payload POSTs collected data to a remote C2. Three packages sharing an identical test.js (SHA256: 11d75fe484) were published by the same throwaway Gmail account within 42 minutes on 2026-03-16. package.json postinstall runs 'node test.js'. test.js is a 24.2 KB file containing Function('GdyTJiB', '<encrypted body>')({...}) with a custom string-array rotation cipher. Production deps axios ^1.7.0 + form-data ^4.0.0 are the HTTP exfil mechanism; child_process ^1.0.2 enables command execution; os ^0.1.2 provides system fingerprinting.