GCVE-110-OSM-2026-7117

Malicious package detected. Behaviors: code execution, network activity, obfuscated code. ENTRY index.js (main: index.js) DESTINATION - deobfuscated: feross.org (fetched-payload, deobfuscated) EXFIL - Fetch and Eval/Exec in index.js: "fetch(atob(randomStringRe)) .then((t) => t.json()) .then((data) => { const codeS..." OBFUSCATION - Decoded Base64 Content in index.js (x2) - Decoded Base64 Content in [deobfuscated] index.js (x2) - IOCs Found in Deobfuscated Code in index.js - Dynamic Base64 Decoding in index.js: "atob(randomStringRe)" - Obfuscation: function to array replacements in index.js - recovered 3 urls, 2 domains, 1 ipv4, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Dynamic Code Execution in index.js: "eval(codeString)" - Publisher Has Other Malicious Packages - Rapid Version Publishing PAYLOAD FILES index.js (+ [deobfuscated] index.js) INDICATORS (IOCs) - ipv4: 13.3.3.7 - urls: https://feross.org, https://www.patreon.com/feross, https://feross.org/support, https://www.jsonkeeper.com/b/PT0ON, https://www.jsonkeeper.com/b/CWOV9 - domains: substack.net, www.patreon.com, www.jsonkeeper.com - emails: feross@feross.org, toots@rastageeks.org, mail@substack.net - payloadFileHash: 379406f8a9339f033be1f802002b78048778ab88d3049b8cea7fcf9e70fd54d1