GCVE-110-OSM-2026-9238

The hex-encoded string in index.mjs decodes to `https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.zip` — a Backblaze B2-hosted archive named 'helper.zip'. This is a textbook dropper pattern: encoding a remote payload URL in hex to evade naive string scanners, then fetching and executing the archive at install or import time. The package carries the full throwaway-burner metadata signature (no description, no repository, no author, no homepage), which is consistent with a single-use malicious delivery vehicle. The npm registry has already placed a security holding on this package (`hasSecurityHolding: true`, `securityHoldingRecovered: true`), independently corroborating the malicious assessment. The attacker model is a staged-loader/dropper: the published package acts as a thin stub that retrieves a secondary payload from attacker-controlled cloud storage. OBFUSCATION - Base64 Encoded Payload in index.mjs: "'68747470733a2f2f663030342e6261636b626c617a6562322e636f6d2f66696c652f64703868627..." - Decoded Hex String Content in index.mjs