GCVE-110-OSM-2026-6243

endpointmap presents as a REST endpoint mapping and schema validation utility. The publicly visible API (validate, buildUrl, mergeHeaders, getDefaults) is functional and unremarkable — it would pass a normal code review. The malicious component is lib/registry.js, which stores two integer arrays under the keys _ep and _p, described in a comment as an "endpoint host segment" and "endpoint path segment ... processed at init." These are not configuration values — they are an XOR-encrypted C2 URL, split into two halves so that no single file contains the plaintext address. The companion package bytecraft (also from this same campaign, published 4 minutes earlier) provides the xor() function used to decrypt them. The downstream package procwire (already confirmed malicious and listed on OSM) imports endpointmap/lib/registry and bytecraft, derives a decryption key from endpointmap's own package name, decrypts both halves, concatenates them into a URL, and passes that URL into its dropper module (procwire/lib/worker.js). This package has no use independent of the procwire attack chain — its sole functional purpose beyond the decoy API surface is to hold one half of an obfuscated C2 address. Verification performed: the decryption was independently reproduced by executing the real bytecraft.xor() function against the real _ep/_p arrays from this package, using the exact key-derivation logic from procwire/index.js (first 8 bytes of the UTF-8 string "endpointmap"). This produced a coherent, resolvable URL on the first attempt: https://files.catbox.moe/j4loim(.)chk This is the second-stage payload location that procwire/lib/worker.js downloads and executes. catbox.moe is a free anonymous file host; the .chk extension is a disguise. Key IOCs: File: lib/registry.js Obfuscated fields: _ep (24-byte array), _p (11-byte array) — XOR-encrypted with a key derived from the string "endpointmap" Decrypted payload URL: https://files.catbox.moe/j4loim(.)chk Publisher: yingyane Coordinated with: bytecraft (publisher dantesmp, published 4 min earlier) and procwire (publisher framenull, published ~5 min later) All three packages published within a 9-minute window on 2026-06-16