GCVE-110-OSM-2026-5918

The entrypoint `index.js` contains a sophisticated steganographic obfuscation technique: invisible Unicode variation-selector codepoints (U+FE00–U+FE0F and U+E0100–U+E01EF) are embedded directly in the source string literal and decoded at runtime into hex digits, then passed to `eval(Buffer.from(..., 'hex').toString())`. The decoded payload fragment is itself AES-256-CBC encrypted (`require('crypto').createDecipheriv('aes-256-cbc', 'zetqHxyFoD...`)`, indicating a two-layer obfuscation chain designed to defeat static analysis. This is a deliberate, sophisticated supply-chain attack — steganographic Unicode encoding is not an accidental pattern, it requires explicit implementation to hide a second-stage loader inside what appears to be a legitimate Git automation tool. The attacker model is a credential-harvesting or remote-execution implant delivered as a developer tool, consistent with campaigns targeting software engineers via malicious npm packages. ENTRY index.js (bin: index.js) EXFIL - Git Configuration Access in src/git/index.js: "git config user.name" - System Information Collection in src/commands/branch.js: "process.platform" - System Information Collection in src/config.js: "os.homedir()" ADDITIONAL FINDINGS - Base64 Decoded Eval in index.js: "eval(Buffer.from(" - Shell Command Execution in src/utils/shell.js: "execSync(" - Rapid Version Publishing PAYLOAD FILES src/git/index.js (+ index.js, src/commands/branch.js) INDICATORS (IOCs) - urls: https://sheets.new - payloadFileHash: 62975b4fb21c1b86bb81b2ad2441faee42a8202f5039bae82dd0072fe2b8d916