GCVE-110-OSM-2026-9022

This package masquerades as a legitimate logging utility: index.js exports itself as `module.exports.pino = middleware`, directly impersonating the pino logger, while importing `lib/config.js` — a 4MB+ obfuscator.io-packed payload containing 264,000+ hex escape sequences and proxied array-function replacements. That obfuscated file invokes `execSync`, indicating shell command execution hidden behind the obfuscation wall. The declared dependency `axios` is independently flagged as known malicious, suggesting the attacker model involves remote exfiltration once the payload executes. The package has zero legitimate metadata (no description, no repository, no homepage) and a `hasSecurityHolding` flag confirmed recovered, placing it firmly in the burner/throwaway attacker-package archetype. The IOC `http://192.168.1.42:9200` embedded in the obfuscated code likely targets an Elasticsearch endpoint for data staging or exfil within targeted network environments. ENTRY index.js (main: index.js) OBFUSCATION - Obfuscation: augmented proxied array function replacements in lib/config.js - Hex Encoded Strings in lib/config.js: "'\x6b\x67\x64\x57\x4e\x35\x73\x6e\x69\x66\x6d'" - Unicode Escape Obfuscation in lib/config.js: "\x57\x51\x42\x64\x56\x74\x61\x69\x73\x47" - Obfuscation: obfuscator.io in lib/config.js - Obfuscation patterns: hexHeavy in lib/config.js ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Dynamic Code Execution in lib/redaction.js: "exec(str)" - Malicious Dependency Detected in package.json PAYLOAD FILES lib/config.js (+ lib/redaction.js) INDICATORS (IOCs) - urls: http://192.168.1.42:9200 - domains: YM.Eu, YM.io, Ey.io, Ey.iO, Ey.By - payloadFileHash: 1176d4dea79d83166810bfe267ee4e31daa9c1b6d31c351c126bca6b1afb6a61