GCVE-110-OSM-2026-5889

This package is part of a deliberate typosquatting campaign: the publisher `matthew_r2` owns 10 packages, every one a near-miss of `react` or `express` (e.g., `reac.js`, `react.j`, `react.ja`, `ekspres`, `expres.js`). The install hook spawns a persistent terminal window on all three major platforms and executes `app.js` — an unusual behavior for any legitimate library and consistent with a persistence/execution implant targeting developers who mistype `react`. `app.js` contains `eval(rAIo)`, where `rAIo` is an opaque variable almost certainly assembled or decoded elsewhere in the file, providing a second-stage execution vector. The IOCs recovered as 'emails' (`6%5E@I0.XZ`, `6%5E@I0.ZYC`, `Y0.@I0.XS`, etc.) are URL-percent-encoded strings where `%5E` decodes to `^`, suggesting obfuscated domain or exfil endpoint fragments hidden in the source. The attacker model is a supply-chain typosquat that, upon install, persists a background process and eval-executes a dynamically decoded payload. ENTRY install.js (install-hook: node install.js) - Install Hook Executes Local JS File in package.json EXFIL - System Information Collection in install.js: "os.platform()" ADDITIONAL FINDINGS - Dynamic Code Execution in app.js: "eval(rAIo)" - Shell Command Execution in install.js: "require('child_process')" - Shell Command Variable Setup in install.js: "win32') { exec('start cmd /k "node app.js"'); } else if (platform == 'linux') { ..." PAYLOAD FILES install.js (+ app.js) INDICATORS (IOCs) - emails: 6%5E@I0.XZ, 6%5E@I0.ZYC, 6%5E@I0.XS, Y0.@I0.XS, 6.ZYC%5E@I0.XS (+1 more) - payloadFileHash: 631307a6c040c82582d0c6dd1771efe26321fbbf351bac991af6c47e6446c757