GCVE-110-OSM-2026-3162

Downloads and executes a second-stage JavaScript payload from a dead-drop at api.npoint.io during npm install via a postinstall hook, spawning a detached Node.js process that persists after installation completes. dist/postinstall.js (sha256: 5f56892ba3e5445aeef5969d124d114477512fefd77a309082e3d77381c03d00) decodes a base64-encoded URL via atob('aHR0cHM6Ly9hcGkubnBvaW50LmlvLzk4NGI3NWMwMjJhNzBjZjAwYzM5') to obtain 'https://api.npoint.io/984b75c022a70cf00c39', fetches the response via axios.get, extracts the .data.content field (stage-2 payload), and executes it in a detached Node.js process (spawn('node', [], {detached:true, stdio:['pipe','ignore','ignore']}); child.unref()) with the payload written to child stdin. Stage-2 payload at api.npoint.io/984b75c022a70cf00c39 (91.4KB) confirmed live during analysis: RC4+Base64 obfuscated JavaScript dropper in {"content":"..."} envelope, same obfuscation family as jsonkeeper.com payloads in this campaign. Package impersonates the legitimate clsx utility, spoofing author Luke Edwards (luke.edwards05@gmail.com). No repository URL, manual publish, no git HEAD.