GCVE-110-OSM-2026-6425

Executes attacker-controlled JavaScript at install-time by fetching a remote payload from a jsonkeeper.com dead-drop and running it via tmpfile require, then destroys all evidence with anti-forensics cleanup. Part of a campaign cluster sharing the wpc- dropper infrastructure; functionally identical to webpack-cache-clean@0.1.4. Stage-2 payload capabilities are unknown — the C2 endpoint was not resolved at analysis time. Trigger: postinstall via loader.js. loader.js hex-decodes the C2 URL inline (Buffer.from hex → https://jsonkeeper.com/b/INN1F), fetches the payload via https.get, reads manifest.session from the JSON response, writes it to os.tmpdir()/wpc-<random>/cfg-<timestamp>.js, and require()s it for execution. After execution: fs.unlinkSync(tmpFile) + fs.rmdirSync(tmpDir) removes all traces (anti-forensics). Stage-2 capabilities unknown — C2 payload not resolved at analysis time.