GCVE-110-OSM-2026-3334

Executes arbitrary remote code at require-time by fetching a JSON payload from https://www.jsonkeeper.com/b/ZNKAU and passing the response's `content` field directly to `eval()`. Stage-2 payload is confirmed BeaverTail, establishing C2 connections to 78.142.218.27:1244 and 66.235.168.17:1244, dropping a persistent implant at .vscode/f.js, and transmitting victim telemetry. Package masquerades as the Node.js built-in `path` module. **Trigger** (require-time IIFE): path.js fires `loadStringData()` immediately on `require()`. **C2 fetch**: `randomStringRe` is a base64-encoded URL literal (`aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9aTktBVQ==`); `atob(randomStringRe)` decodes to `https://www.jsonkeeper.com/b/ZNKAU`. **eval sink**: `fetch(url).json()` extracts `data.content` and passes it directly to `eval(codeString)`. **Stage-2 (BeaverTail)**: establishes C2 connections to 78.142.218.27:1244 and 66.235.168.17:1244; drops `.vscode/f.js` as a persistent implant; POSTs victim telemetry to C2. A second stage slot (`loadTokenData`/`tokenStringRe`) exists in source but is currently disabled (empty string value).