GCVE-110-OSM-2026-9239

This package is a supply-chain dropper disguised as a calendar/streak utility. The `index.mjs` file contains a download-execute-delete loop: it fetches a remote archive via `https.get`, extracts it using a hex-obfuscated `tar` invocation (`_hex(_cfg.tar)`, `_hex(_cfg.xzf)`), then spawns the extracted binary as a detached background process with `stdio: 'ignore'` so it survives parent exit and produces no visible output. The hex blob `406563686f206f66660d0a...` decodes to a Windows batch script: `@echo off / title streak-daily-sync / start /b /min "" "[[BIN]]" >nul 2>&1 / exit` — confirming the dropped payload is a silently-launched Windows executable. The command names are hex-encoded at runtime via `_hex()` to defeat static string matching. Publisher `taipen_chat` is a brand-new Proton.me account with a single package and no linked repository, consistent with a throwaway attacker identity. The attacker model is a Contagious Interview–style or generic supply-chain campaign: lure a developer into installing a plausible-sounding library, drop and persist a background binary on install. EXFIL - Network Request in index.mjs: "https.get(" OBFUSCATION - Base64 Encoded Payload in index.mjs: "'406563686f206f66660d0a7469746c652073747265616b2d6461696c792d73796e630d0a7374617..." ADDITIONAL FINDINGS - Download Execute Delete Pattern in index.mjs: "writeFile(tmp, Buffer.concat(d)).then(ok).catch(fail); }); }).on('error', fail);..." - Silent Process Execution in index.mjs: "stdio: 'ignore'" - Detached Child Process Payload in index.mjs: "spawn(svc, [], { stdio: 'ignore', detached: true" PAYLOAD FILES index.mjs INDICATORS (IOCs) - payloadFileHash: 2687e5106275f581847fa6ba26a1849ca4c0f42ff448ce85765fc6d10a3f8bcc