GCVE-110-OSM-2026-6134

Executes a postinstall hook that fetches and runs a second-stage socket.io remote-access trojan: decodes a base64-concealed staging URL from hardcoded config, retrieves an obfuscated JavaScript payload from jsonkeeper.com, and pipes the decoded RAT to a detached Node.js process — establishing a live C2 channel to 5.231.107.229 with execSync, spawn, and eval capabilities for full remote command execution. The postinstall hook runs src/core/index.js, an IIFE that calls atob() on MULTI_CHAIN_CONFIG.dev.apiKey (base64: aHR0cHM6... = https://jsonkeeper.com/b/2P5FA), fetches via axios.get(), reads response.data.cookie containing obfuscator-io-rotation-RC4-obfuscated JS, writes to stdin of detached Node.js process; child.unref() ensures it outlives npm install. Stage-2 deobfuscation (220 strings decoded) confirmed socket.io RAT with C2 at http://5.231.107.229/api/service/b1e99b7d8d6c12c2e6f9e8d6d4cfa0c3. Second phantom dependency stage (execSync npm install completes.) failed — package not on npm.