GCVE-110-OSM-2026-14419

This package includes a package.json file and a 4.6mb index.html file. The index.html file includes a browser-based remote-content loader inside a captured calculator page. When the bundled HTML is opened, hidden keyboard commands can activate the loader and transfer execution to attacker-controlled remote HTML. Static analysis of tungtungisgoated (all versions) identified an appended keydown listener in index.html. It retains the last eight unmodified printable characters and recognizes six case-insensitive trigger phrases. Each trigger selects one of five CDN mirrors, performs an unauthenticated browser GET for a GitHub-hosted HTML object, reads the response as text, opens a blank tab, and writes the returned HTML with document.write(), allowing scripts in that response to execute. The visible stage does not upload the buffered keystrokes and contains no npm lifecycle hooks, subprocess execution, filesystem persistence, registry persistence, or blockchain activity. The remote HTML was not retrieved, so its behavior and any subsequent payload stages remain unresolved.