GCVE-110-OSM-2026-1405

Executes attacker-controlled second-stage Node.js payload on every require() by fetching from https://api.npoint.io/ef2875f70e59e319189d and invoking the response via `new Function.constructor('require', response)`. The C2 URL is hardcoded as a base64 constant in lib/caller.js, ensuring unconditional execution. Part of the DPRK-chai-npoint cluster (same mechanism as chai-as-elevated, chai-as-mobj, chai-as-encrypted). lib/caller.js decodes a hardcoded base64 constant to https://api.npoint.io/ef2875f70e59e319189d, performs an axios GET with a custom header derived from lib/const.js, extracts the .cookie field from the JSON response, constructs a Function via `new Function.constructor('require', response)`, and calls it with the host process's require — granting the stage-2 payload full Node.js module access.