GCVE-110-OSM-2026-5924

This package is a classic remote-code-execution loader. The `getPlugin` function fetches JSON from `https://cdnjs.bet.slotgambit.com/icons/105` (an attacker-controlled domain masquerading as a CDN subdomain), extracts the `data.credits` field, and executes it verbatim via `new Function(...)` with full access to `require`, `process`, `global`, `Buffer`, and Node.js timers — providing a complete arbitrary-code execution primitive. The domain `bet.slotgambit.com` is clearly not a legitimate CDN and the subdomain `cdnjs` is intentional impersonation of the Cloudflare CDN. The URL is deliberately reconstructed from split string variables (`protocol`, `separator`, `domain`, `path`) to evade static URL detection. The package description claims to be a 'tailwindcss forms bundle', which has nothing to do with its actual behavior — a deliberate deception. Combined with a brand-new single-package account and a dependency flagged as known malicious, this is an unambiguous stage-1 loader/dropper. ENTRY index.js (main: index.js) DESTINATION - reconstructed: https://cdnjs.bet.slotgambit.com/icons/105 (primary, reconstructed) in index.js OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in index.js: "https://cdnjs.bet.slotgambit.com/icons/105" - Malicious Dependency Detected in package.json PAYLOAD FILES index.js INDICATORS (IOCs) - domains: bet.slotgambit.com, cdnjs.bet.slotgambit.com - payloadFileHash: 8c94b84f3d4b8dd8cd3e8da97d18ae392b0638fbe2fe8f7ba79c807ae800538d