GCVE-110-OSM-2026-4532

Executes attacker-controlled JavaScript at require time through a detached child process. The package fetches `https://aqua-margit-84.tiiny.site/index.json` with `x-secret-key: _`, extracts the returned JSON `cookie` field, and evaluates it with the Function constructor. A secure-get retrieval and js_solver decode confirmed the obfuscated stage performs host, OS, username, WSL, and environment discovery and contains socket.io/child_process execution and upload logic. `index.js` launches `lib/initializeCaller.js` as a detached Node child process when the package is imported. The worker base64-decodes the tiiny.site stage URL and request header, fetches the JSON stage through axios, and executes `response.data.cookie` via `new Function.constructor("require", response)`. The decoded stage references `socket.io-client`, `sql.js`, `form-data`, `axios`, `execSync`, Windows `cmd.exe` username discovery, `/proc/version` WSL checks, `/mnt/c/Users` inspection, and upload endpoint fragments that reconstruct to `http://144.172.89.180:8085/upload` and `http://144.172.89.180:8086/upload`.