GCVE-110-OSM-2026-9226

This package presents as a legitimate TailwindCSS UI plugin but embeds a hidden malicious payload in plugin.js using classic steganographic techniques: whitespace-padded concealment (70+ tabs after a statement) and heavy unicode escape obfuscation (230+ escapes) to hide `child_process` invocation and network communication. The decoded unicode content reveals `https://eth.drpc.org` as a C2 endpoint, used via `http.get()` within a JSON-RPC formatted request structure (`JSON.stringify({jsonrpc:"\u0032\u002E\u0030",...method:m,params:p})`), consistent with a crypto wallet drainer or command-and-control beacon using Ethereum node RPC as cover infrastructure. The `global['r']=require` pattern is a textbook obfuscated require alias used to hide dynamic module loading, combined with `child_process` access decoded from unicode — the attacker model is a supply-chain implant that executes system commands and communicates with an Ethereum RPC endpoint, likely for wallet theft or environment reconnaissance. Minimal metadata (no description, no repository) and the structural mismatch between the legitimate-looking UI component imports and the deeply obfuscated hidden payload section confirm adversarial intent. ENTRY plugin.js (main: plugin.js) DESTINATION - custom-c2: https://eth.drpc.org (primary, decoded) in plugin.js - custom-c2: eth.drpc.org (decoded) in plugin.js EXFIL - Network Request in plugin.js: "http.get(" OBFUSCATION - Decoded Unicode Escape Content in plugin.js (x9) - Whitespace-Padded Hidden Payload in plugin.js: "; global" - Unicode Escape Obfuscation in plugin.js: "\u006F\u0062\u006A\u0065\u0063\u0074" - Deobfuscation Failed in plugin.js - Obfuscation patterns: unicodeHeavy in plugin.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Global Require Alias in plugin.js: "global['r']=require" - Platform Detection with Data Collection in plugin.js: "JSON.stringify({jsonrpc:"\u0032\u002E\u0030",id:1,method:m,params:p}))).result,F..." PAYLOAD FILES plugin.js INDICATORS (IOCs) - ipv6: e:: - urls: https://tailwindcss.com, https://niraui.onrender.com/components/index.html, https://niraui.onrender.com/docs/customize.html, https://niraui.onrender.com/index.html - domains: niraui.onrender.com, tailwindcss.com - payloadFileHash: 32cbc385074696971bb96a86b23483ce77ec1ff1d18259277aa47512f54e838e