GCVE-110-OSM-2026-3332

Executes a character-shuffle obfuscated IIFE at require-time via an IIFE appended after legitimate TailwindCSS plugin code, querying TRON, Aptos, and BSC blockchain APIs with hardcoded attacker-controlled wallet addresses. Behavior is consistent with blockchain-as-C2 beaconing or targeted reconnaissance against cryptocurrency developers. Actor infrastructure domain kowaki4759.marvetos.com present in package metadata. Publisher is a confirmed DPRK DeceptiveDevelopment actor. **Trigger** (require-time IIFE): obfuscated IIFE in src/index.js executes immediately on `require()` of the package. **Obfuscation**: character-shuffle-sfl variant; 57 strings decoded from rotation cipher. **Execution**: `child_process.spawn('node', ['-e', <dynamically constructed payload>])` spawns a new node process. **Blockchain queries**: queries TRON (api.trongrid.io), Aptos (fullnode.mainnet.aptoslabs.com), and BSC (bsc-dataseed.binance.org, bsc-rpc.publicnode.com) APIs with hardcoded attacker-controlled TRON wallet addresses TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP and TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG and ETH/BSC tx hashes 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e and 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3. **Actor infrastructure**: package metadata author email domain kowaki4759.marvetos.com is attacker-controlled infrastructure.