GCVE-110-OSM-2026-9083

The entrypoint index.js contains a classic stager pattern: `load_address_database()` reads `test_address_list.js`, decodes its contents from base64 via `Buffer.from(result, 'base64')`, then immediately executes the decoded payload with `eval(data.toString('utf-8'))`. This is a well-known two-stage loader technique where the actual malicious payload is hidden inside a seemingly innocuous file. The package additionally depends on a version of axios flagged as known-malicious by OpenSourceMalware.com, and the publisher email domain `installer.ink` is a non-standard TLD strongly associated with malware distribution infrastructure. The brand-new single-package account (idipharma_official_work) with no repository, combined with the eval-of-decoded-file pattern, leaves no plausible legitimate interpretation. ENTRY index.js (main: index.js) EXFIL - Network Request in form_data.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in index.js: "Buffer.from(result, 'base64')" - Deobfuscation Failed in index.js ADDITIONAL FINDINGS - Dynamic Code Execution in AxiosHeaders.js: "exec(str)" - Malicious Dependency Detected in package.json PAYLOAD FILES AxiosHeaders.js (+ form_data.js) INDICATORS (IOCs) - payloadFileHash: a00559ac85f8f2b4c3522e8d32a75a946e618082267cb203a31f82d96aa74621