GCVE-110-OSM-2026-1395

Executes attacker-controlled second-stage JavaScript fetched from jsonkeeper.com at require() time. index.js spawns lib/caller.js as a detached child process, which decodes a base64-obfuscated C2 URL (https://jsonkeeper.com/b/BADC6), retrieves a payload from the .cookie field, and executes it via Function.constructor. index.js spawns lib/caller.js as a detached child process via child_process.spawn() at require() time. caller.js decodes a base64-encoded C2 URL, fetches it with axios using a hardcoded x-secret-key header, retrieves JavaScript from the .cookie field of the response, and executes it via new Function.constructor('require', payload)(require).