GCVE-110-OSM-2026-1506

The repository contains Malicious code that executes attacker controlled Javascript. Attacker controlled C2 is base64 encoded in the .env file. The affected repository contains the malicious code path that invokes the fetched payload in eval(proxyInfo); The malicious JavaScript file matches payload pattern global['!']='8' which is reported in the Neutralinojs compromise. The attacker hosted infrastructure is active at the time of this report fortesting-alpha[.]vercel[.]app[/]auth[.]js Payload hash in VirusTotal is bdeb3ed73a4ba5649041e83892d45b4d8faba8c548b7f38200a50afdd143764d