GCVE-110-OSM-2026-1893

DPRK-attributed npm package from Contagious Interview / Lazarus Group campaign. Package identified in kmsec.uk DPRK research database (verdict: malicious, dprk). osmalyze static analysis confirms malicious behavior: 0 critical + 3 high findings across rules: hex-encoded-strings,new-package,no-repository,obfuscation-augmented,obfuscation-control-flow-flattening,obfuscation-hex-heavy,obfuscation-hex-variables,obfuscation-obfuscator,unicode-escape. Payload file: dist/bundle.js. === DPRK ATTRIBUTION === Source: kmsec.uk DPRK Research Database (https://dprk-research.kmsec.uk/) Verdict: malicious, dprk First released: 2026-04-11 === OSMALYZE SCAN === Severity: 0 CRITICAL, 3 HIGH Payload file: dist/bundle.js Rules triggered: hex-encoded-strings,new-package,no-repository,obfuscation-augmented,obfuscation-control-flow-flattening,obfuscation-hex-heavy,obfuscation-hex-variables,obfuscation-obfuscator,unicode-escape === IOCS === From kmsec DB: none From scan URLs: none From scan domains: none Payload SHA256: 463c6edb3efde7f14419df5f782ca645d956bb236fb08f618c768e855c069588