GCVE-110-OSM-2026-5075

Malicious package detected. Behaviors: code execution, network activity, obfuscated code. Entrypoint: index.js (main: index.js) Payload: index.js Key findings: - Fetch and Eval/Exec in index.js: "fetch(atob(tokenStringRe)) .then((t) => t.json()) .then((data) => { ..." - Decoded Base64 Content in index.js - Decoded Base64 Content in index.js - Dynamic Code Execution in index.js: "eval(codeString)" - Dynamic Base64 Decoding in index.js: "atob(randomStringRe)" IOCs: - ipv4: 13.3.3.7 - urls: https://feross.org, https://www.patreon.com/feross, https://feross.org/support, https://www.jsonkeeper.com/b/PT0ON, https://www.jsonkeeper.com/b/FDDQS - domains: feross.org, substack.net, www.patreon.com, www.jsonkeeper.com - emails: feross@feross.org, toots@rastageeks.org, mail@substack.net - payloadFileHash: 783462d863b0ccab31c63509b74703a63acd0d8221d5f9ed9473dd987bced97b Decoded/deobfuscated IOCs: - urls: https://www.jsonkeeper.com/b/PT0ON, https://www.jsonkeeper.com/b/FDDQS - domains: www.jsonkeeper.com