GCVE-110-OSM-2026-13891

This package is published by a confirmed malicious burner account ('pckzbtyl', 4 days old, 7 random-named packages) that already has one package flagged as critical malware in OSM ('nsdhjuiwqxmhsf1'). The entrypoint is index.html, which masquerades as a Cloudflare 'Just a moment...' CAPTCHA challenge page — a well-documented technique used by threat actors to disguise malicious payloads as legitimate browser security checks. Beneath that facade lies a heavily obfuscated JavaScript payload using string-array obfuscation with hundreds of encoded strings, dynamic atob() decoding of runtime variables, and unicode hex escapes — all consistent with second-stage loader obfuscation. An npm package with no description, no repository, and a main entrypoint pointing to an HTML file containing this obfuscation pattern has no plausible legitimate explanation; the attacker model is a staged payload delivery where the Cloudflare façade distracts manual reviewers while the obfuscated JS executes on install or load. ENTRY index.html (main: index.html) OBFUSCATION - Dynamic Base64 Decoding in index.html: "atob(_0x2ed256)" - String Array Obfuscation in index.html: "['zwn1CML0Esb2zq','iIbYzwW9iM5VBW','cIaGicaGicaGia','ignSyxnZpsjJBa','Dg9Y','ug9..." - Unicode Escape Obfuscation in index.html: "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Has Other Malicious Packages - Publisher Shows Burner-Account Pattern - Rapid Version Publishing PAYLOAD FILES index.html