GCVE-110-OSM-2026-5906

The entrypoint `dist/bootstrap.js` is an HTA-context PowerShell dropper/stager. It uses `ActiveXObject` to create `%LOCALAPPDATA%\Landpage`, fetches a remote PowerShell script authenticated with session tokens, payload digests, and device fingerprints, XOR-decrypts the payload using a hardcoded key (`950bc06e05fab613ff99c71ce4fdd4ef`), writes it to disk, and executes it silently via `powershell.exe -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden`. The hidden-window execution and multi-path fallback chain (direct fetch → XOR-decrypted stub → CDN-hosted encrypted blob → base64 obfuscated fallback) are characteristic of a staged malware loader, not a legitimate CDN bootstrap. The rapid-iteration publishing pattern (12 versions in under 2 days from a brand-new single-package account) is consistent with adversarial tuning of a delivery mechanism, matching the Contagious Interview/social-engineering dropper attacker model where victims are tricked into running an HTA file that silently installs malicious payload. ENTRY dist/bootstrap.js (main: dist/bootstrap.js) INDICATORS (IOCs) - urls: http://192.168.1.143:3001