GCVE-110-OSM-2026-5984

This package is a heavily obfuscated dropper consistent with the DPRK Contagious Interview campaign. The entrypoint immediately collects system fingerprint data via the `os` module (hostname `G`, username `Z`, platform `j`, homedir `p`) and constructs C2 URLs in variables `X` and `z`. The `H` function is an XOR decryption routine operating on hardcoded byte arrays (`k`, `O`, `K`, `Q`, `ct`, `et`, `st`, `at`, `it`, `tt`) to reconstruct paths, commands, and endpoints at runtime — a classic runtime-evasion technique. The `_` function fetches a remote payload via HTTP (`$[F]`), writes it to a derived local path, and chains into `nt`→`ot`→`lt`→`ut`, a staged execution pipeline that ultimately calls child_process exec/spawn. The package name 'database-security-scanner' is a known social-engineering lure used to trick developers into running malicious packages during fake technical interviews, matching the Contagious Interview attacker model. ENTRY index.js (main: index.js) OBFUSCATION - Obfuscation: augmented proxied array function replacements in index.js - String Array Obfuscation in index.js: "['ChnqzwS','AM9PBG','mJy4odGZofDYr25UwG','v0HSA2K','y0rVDKW','mtqYodGYmgXgqMzRBq..." - Obfuscation (osm-deobfuscator): unknown in index.js - Strings Extracted from Deobfuscated Code in index.js ADDITIONAL FINDINGS - Brand New Package PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: d5b68484311e4039901d8a840c70d49e4332cf99181c747b08d86ddb5933fdad