GCVE-110-OSM-2026-2594

Typosquat of @tailwindcss/line-clamp with a 3-layer obfuscated payload (string-shuffle cipher + Function constructor eval) that monitors 4 hardcoded cryptocurrency wallet addresses (2 Tron, 2 Aptos) via blockchain API queries at require-time in a rapid polling loop. Writes transaction results to local files. **Trigger** (require-time): `src/index.js` executes immediately on `require()` — no install hook. **Obfuscation**: 3-layer chain — `_$_1e42` string-shuffle decoder resolves global references (`require`, `module`), then `sfL` shuffle function decodes a large string blob, passed through Function constructor (`dgC`/`jFD`) to build and execute final payload via `xBg`/`pYd`/`Tgw` chain. **Surveillance**: decoded payload queries 4 blockchain API endpoints in a rapid polling loop (~0.16ms interval): - `GET https://api.trongrid.io/v1/accounts/TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP/transactions` - `GET https://api.trongrid.io/v1/accounts/TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG/transactions` - `GET https://fullnode.mainnet.aptoslabs.com/v1/accounts/0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e/transactions` - `GET https://fullnode.mainnet.aptoslabs.com/v1/accounts/0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3/transactions` **File writes**: results written to local files named `1` and `2`. **Cover**: legitimate @tailwindcss/line-clamp plugin code included to appear functional.