GCVE-110-OSM-2026-9087

This package presents a classic malicious npm package pattern: a brand-new publisher account (npmUserPackageCount: 0, no repository, no homepage) publishing a heavily obfuscated `index.js` that, when deobfuscated, reveals a hardcoded C2 endpoint at `http://5.231.107.184/api/service/b18007f4ab55491285bf8e7b0ba3cd56`. The obfuscation uses proxied array-function replacement with RC4/XOR-style string decryption routines — a technique consistent with stealer and RAT dropper families used in supply-chain attacks. The recovered IOC is a raw IPv4 address (not a CDN or legitimate service), with a UUID-style path strongly suggesting a unique victim beacon or payload-fetch endpoint. The 'high-performance thread-safe cache' description is a social engineering lure with no source repository to verify the claimed functionality. ENTRY index.js (main: index.js) OBFUSCATION - IOCs Found in Deobfuscated Code in index.js - Obfuscation: augmented proxied array function replacements in index.js - Obfuscation (osm-deobfuscator): unknown in index.js - recovered 1 ipv4, 1 urls from decoded/deobfuscated content PAYLOAD FILES index.js INDICATORS (IOCs) - ipv4: 5.231.107.184 - urls: http://5.231.107.184/api/service/b18007f4ab55491285bf8e7b0ba3cd56 - payloadFileHash: 10f932f2a7be5c474824eb078a881c5276dddb58c5ba12091bb65bc7b82f8e59