GCVE-110-OSM-2026-1396

Executes attacker-controlled second-stage Node.js payload on every require() by fetching from https://api.npoint.io/31bccfbf4ee2732207a4 and invoking the response via `new Function.constructor('require', response)`. The C2 URL is hardcoded as a base64 constant in lib/initializeCaller.js. Part of the DPRK-chai-npoint cluster alongside chai-as-elevated, chai-as-inserted, and chai-as-encrypted, confirmed by shared index.js SHA256. lib/initializeCaller.js decodes a hardcoded base64 constant (DEV_API_KEY) to https://api.npoint.io/31bccfbf4ee2732207a4, performs an axios GET with a custom header, extracts the .cookie field from the JSON response, constructs a Function via `new Function.constructor('require', response)`, and calls it with the host process's require — granting the stage-2 payload full Node.js module access. Each package in the cluster uses a unique npoint.io bin ID.