GCVE-110-OSM-2026-13893

This package is a browser-hijacking tool masquerading as an SVG asset library for the 'Securly' educational filtering service. The decoded base64 payload in `catclass.svg` contains a fully functional browser homepage/proxy application with a Discord channel link (`https://discord.catclass.org`), a WebSocket proxy server (`wss://my.browser-education.space/api/`), and an ad injection script loaded from a suspicious domain (`dyingefforlessefforlessours.com/5e/3f/7e/5e3f7e76b7c14c5fd4ca706f064685e4.js`). The `duckmath.svg` file contains dynamic base64 decoding (`atob()`) and `.profile` persistence references indicating startup persistence. The `svg/icon.svg` and `svg/index.svg` files use multi-layer unicode escaping to hide code referencing `localhost`, `hostname`, `split`, and `createElement` — classic indicators of a browser extension or page injection payload. The 3-day-old publisher account `theofficalnothing` (note misspelling of 'official') and the single-package profile complete the picture of a throwaway account used for malicious distribution. The attacker model is a browser proxy/unblocking tool designed to bypass school content filters, with ad monetization and potential credential harvesting via the login overlay. PERSISTENCE - Startup Persistence in duckmath.svg: ".profile" OBFUSCATION - Decoded Base64 Content in catclass.svg - Decoded URL Encoded Content in securly.svg (x3) - Decoded Unicode Escape Content in svg/icon.svg (x25) - Decoded Unicode Escape Content in svg/index.svg (x25) - Dynamic Base64 Decoding in catclass.svg: "atob(b)" - Dynamic Base64 Decoding in duckmath.svg: "atob(_c[" - Base64 Encoded Payload in catclass.svg: ""77u/PCFET0NUWVBFIGh0bWw+PGh0bWwgbGFuZz0iZW4iPjxoZWFkPjxtZXRhIGNoYXJzZXQ9InV0Zi0..." - Base64 Encoded Payload in duckmath.svg: ""H4sIAAAAAAACCty961cay7Y4+v38FdjXy+jeFgTUvBorHGMky6yoJERd0eVlt1DQHaALqxvUCPtvv2P..." (+7 more) ADDITIONAL FINDINGS - Very New NPM Publisher Account PAYLOAD FILES svg/icon.svg (+ svg/index.svg)