GCVE-110-OSM-2026-3163

Downloads and executes a second-stage JavaScript payload from a dead-drop at jsonkeeper.com during npm install via a postinstall hook, spawning a detached Node.js process that persists after installation and targets AWS Lambda deployment environments. postinstall.js (sha256: fd308ff1cb88962c2d77e7cbb3641387d7aca60e596be01ed9cd354a9116de9c) decodes a base64-encoded URL via atob('aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL0JONzdL') to obtain 'https://jsonkeeper.com/b/BN77K', fetches the response via axios.get, extracts the .data.cookie field (the stage-2 payload), and executes it in a detached node process (spawn('node', [], {detached:true, stdio:['pipe','ignore','ignore']}); child.unref()) with the payload piped to stdin. The child process survives npm install completion. require.js reads process.env.LAMBDA_PATH to enumerate AWS Lambda function directories, targeting cloud deployment environments. Stage-2 payload at jsonkeeper.com/b/BN77K (18.6KB) is a live RC4+Base64 obfuscated JS dropper confirmed during analysis (resolved IP: 64.227.108.217). Typosquat of cosmos-sdk. Five of ten files are empty decoys (sha256: e3b0c44...).