GCVE-110-OSM-2026-14

This package masquerades as a legitimate filesystem watcher (typosquatting 'fsevents') but contains a clearly malicious IIFE in index.js. On macOS (non-CI), after a randomized delay of 30–90 seconds, it decodes a base64 C2 URL (`aHR0cHM6Ly9rN3htOXEueHl6` → `https://k7xm9q.xyz`), beacons victim username, hostname, and a hardcoded password string 'npm_fsevent' to `/api/clickfix-callback`, then fetches and pipes a remote payload directly into `/bin/bash` via a second detached, unref'd child process. The code also writes a one-time execution lock to `~/.cache/.nyx-npm/f` to prevent re-execution and explicitly skips CI environments to evade sandbox detection. The attacker model is a supply-chain trojan targeting macOS developers, delivering a remote code execution stage-2 payload. ENTRY index.js (main: index.js) DESTINATION - custom-c2: https://k7xm9q.xyz (primary, decoded) in index.js - custom-c2: k7xm9q.xyz (decoded) in index.js EXFIL - System Information Collection in index.js: "os.hostname()" OBFUSCATION - Decoded Base64 Content in index.js - Decoded Base64 Content in [deobfuscated] index.js - Dynamic Base64 Decoding in index.js: "atob(s)" - Strings Extracted from Deobfuscated Code in index.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn(s1, a1, { detached: true, stdio: 'ignore' }); c1.unref(); setTimeout(funct..." - Shell Command Execution in index.js: "child_process').spawn" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn(s1, a1, { detached: true" - Brand New Package - Rapid Version Publishing PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 0edb1fe1a1b96ac8315d1aad997dcbcf49b852a91fe76bddc2cc24e18f1338f3