GCVE-110-OSM-2026-1592

Backdoor disguised as a Rollup build plugin: getPlugin() fetches JavaScript from attacker-controlled domain rest-icon-handler.store/icons/903 and executes it via eval(JSON.parse(body)), giving the attacker arbitrary code execution in the developer's build environment. setPlugin() performs an identical fetch and eval against rest-icon-handler.store/icons/77. A decoy setDefaultModule() function referencing legitimate CDN providers (Cloudflare, Fastly, Akamai) is included to create the appearance of a legitimate icon-fetching utility. index.js constructs the C2 base URL from split literals: protocol='https', separator='://', subdomain='rest-icon-handler', domain='store', path='/icons/' → https://rest-icon-handler.store/icons/. getPlugin() appends token '903' and setPlugin() appends '77'. Both use the npm 'request' library, call req(options, cb), and in the callback execute eval(JSON.parse(b)) with no validation of the remote content. Retry logic (mreq with atlf counter) ensures the payload fetch is retried on failure. No install hook — triggers when the exported functions are called.