GCVE-110-OSM-2026-14565

This is a DPRK published packge on version 5.1.9-alpha.3. The second stage uses the NullReceiver technique to hide an IP address and C2 in the receiving Ethereum address. The package entrypoint `lib/index.js` implements a custom character-shuffle cipher (`spin()`/`peel()`/`splitLane()`) with hardcoded numeric key arrays (NX, SX) used to decode property names and a large payload string at runtime. The `boot()` function then resolves `peel[ctor]` where `ctor` is the first 11 characters of a decoded string — almost certainly the string `'constructor'`, making `Forge` equivalent to the `Function` constructor — and calls `Forge('z', peel('<large-shuffled-payload>'))` to compile and execute the hidden payload without any of its contents being statically readable. This pattern (custom reversible shuffle cipher + Function-constructor execution of an encoded string) is a deliberate obfuscation technique used specifically to hide malicious logic from static scanners; it is not produced by any standard bundler or minifier. The static analyzer scored this 5/clean because it did not detect the obfuscation layer, but the code structure is unambiguously adversarial. The absence of a source repository and the IOC `http://evil` are corroborating weak signals; the payload content and exfil endpoints cannot be confirmed without runtime deobfuscation. ENTRY lib/index.js (main: lib/index.js) ADDITIONAL FINDINGS - Dynamic Code Execution in lib/answers.js: "exec(s)" PAYLOAD FILES lib/answers.js (+ src/answers.ts)