GCVE-110-OSM-2026-1410

Executes attacker-controlled second-stage JavaScript fetched from jsonkeeper.com at require() time. index.js spawns lib/caller.js as a detached child process, which reads a plaintext C2 URL (https://jsonkeeper.com/b/ZK45J) stored as a literal string, fetches it with axios using an x-secret-key header, retrieves a payload from the .cookie field, and executes it via Function.constructor. index.js spawns lib/caller.js as a detached child process via child_process.spawn() at require() time. Unlike sibling packages in this campaign, env_express stores the C2 URL as a plain literal string (DEV_API_KEY: 'https://jsonkeeper.com/b/ZK45J') with no base64 encoding. caller.js reads this directly, fetches the URL with axios using an x-secret-key header, retrieves JavaScript from the .cookie field, and executes it via new Function.constructor('require', payload)(require).