GCVE-110-OSM-2026-1887

DPRK-attributed npm package from Contagious Interview / Lazarus Group campaign. Package identified in kmsec.uk DPRK research database (verdict: malicious, dprk). osmalyze static analysis confirms malicious behavior: 10 critical + 7 high findings across rules: atob-dynamic-usage,base64-decoded-env,decoded-base64,download-execute,dynamic-code-execution,dynamic-import,env-exfiltration,global-variable-shadowing,new-npm-account-week,new-package,startup-persistence,yara-anti-analysis. Payload file: dist/winston_prisma/transportor.js. === DPRK ATTRIBUTION === Source: kmsec.uk DPRK Research Database (https://dprk-research.kmsec.uk/) Verdict: malicious, dprk First released: 2026-04-09 === OSMALYZE SCAN === Severity: 10 CRITICAL, 7 HIGH Payload file: dist/winston_prisma/transportor.js Rules triggered: atob-dynamic-usage,base64-decoded-env,decoded-base64,download-execute,dynamic-code-execution,dynamic-import,env-exfiltration,global-variable-shadowing,new-npm-account-week,new-package,startup-persistence,yara-anti-analysis === IOCS === From kmsec DB: none From scan URLs: none From scan domains: none Payload SHA256: 81c1cd1e1ada5e40c1a8e18f5e230ac789fe3d913639551f8181dd698e123886