GCVE-110-OSM-2026-8521

This package implements a classic obfuscated dropper/stealer pattern hidden behind a superficially legitimate web3 game assessment library facade. The publisher account is 22 days old, has only 2 packages, spammed 4 versions in under 2 hours, and has no repository or description — all consistent with a throwaway attacker account. [osmalyze-auto] Entrypoint: src/index.js (main: ./src/index.js) Payload: src/index.js Key findings: The entrypoint file appends heavily obfuscated (obfuscator.io, 653 hex variables) code after the plausible-looking exported functions. The deobfuscated logic visible in the sample match reveals: (1) a remote binary is fetched and written to a temp path (with mode 0x1c0/448 = executable), (2) it is spawned detached with `stdio: 'ignore'` and custom env vars `SSTAR_DEPLOYMENT_HASH` and `SSTAR_API_BASE` injected — a classic C2 beacon pattern, (3) simultaneously a `fetch()` POST sends collected data (including `_0x1db83b`, likely a deployment/victim hash) to an attacker-controlled endpoint. Platform detection logic branches for darwin/linux/win32 to select the correct binary name, confirming cross-platform targeting. IOCs: - payloadFileHash: b7c001d6833a6a1fc480b02ed00f47e9317c37419e7935b8c4a77b2db0bef359