GCVE-110-OSM-2026-9052

This package is a remote code execution loader. The URL is assembled from split variables (`protocol`, `separator`, `domain`) to evade naive string-match detection. Publisher `ahmad318` has a prior confirmed malicious package (`polymarket-toolkit`, critical severity), establishing a clear pattern of malicious publishing from this actor. ENTRY index.js (main: index.js) The `getPlugin` function fetches `https://46.183.25.232:45000/icons/109` — a raw IP address masquerading as a CDN via the `cdnjs.` subdomain prefix — and executes the `data.credits` field from the JSON response using `new Function(...)` with full Node.js globals including `require`, `process`, `Buffer`, and `global`. This is a classic stage-2 loader pattern: the attacker controls the server at 46.183.25.232:45000 and can serve arbitrary code that runs with full host access. DESTINATION - reconstructed: https://46.183.25.232:45000/icons/109 (primary, reconstructed) in index.js OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in index.js: "https://46.183.25.232:45000/icons/109" - Publisher Has Other Malicious Packages - Malicious Dependency Detected in package.json PAYLOAD FILES index.js INDICATORS (IOCs) - ipv4: 46.183.25.232 - domains: 46.183.25.232:45000 - payloadFileHash: fb05cbd45b0b0fd5c69ef481f85522fbf8aabbad39cda5538396e930e1113d1c