GCVE-110-OSM-2026-9231

This package implements a trojanized JSON schema validator. The legitimate-looking `index.js` façade calls `core.trigger()` on every invocation of `validateJson` and `validateXml`, which in `lib/core.js` spawns detached background processes using both `process.execPath` and `sh -c` with `stdio: 'ignore'` and `windowsHide: true` — a textbook malware launcher pattern designed to survive parent process exit and hide from the user. The obfuscated `lib/helpers.js` (deobfuscation failed) almost certainly contains the payload delivery logic, and the dynamic `Buffer.from(str, 'base64')` usage in that file corroborates runtime decoding of hidden content. System fingerprinting via `os.platform()` completes a recognizable attacker model: collect environment data, decode and execute a staged payload in a detached invisible subprocess. The burner-account metadata (author 'Jane Doe', no repository, no description) is consistent with a throwaway distribution account. ENTRY index.js (main: index.js) EXFIL - System Information Collection in lib/core.js: "os.platform()" OBFUSCATION - Dynamic Base64 Decoding in lib/helpers.js: "Buffer.from(str, 'base64')" - Deobfuscation Failed in lib/helpers.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in lib/core.js: "spawn(process.execPath, ['-e', childScript], { detached: true, stdio: 'ignore', ..." - Shell Command Execution in lib/core.js: "require('child_process')" - Silent Process Execution in lib/core.js: "stdio: 'ignore'" - Detached Child Process Payload in lib/core.js: "spawn(process.execPath, ['-e', childScript], { detached: true" PAYLOAD FILES lib/core.js INDICATORS (IOCs) - sha256Hashes: 3d212125266f7a7a36313b7b3f263130393c23277b3b30217a323d7a36272c25, 213a3b3a3834316164647a363a3a397820213c39267a2534363e3432307b3f26 - payloadFileHash: c068e70ce599ce7d4cd8d51c6ffc488c386fea4a34b61621383c648ac7f73b43