GCVE-110-OSM-2026-9499

This package implements a classic remote-code-execution loader: it constructs the a C2 URL by splitting the protocol and domain into variables to evade static URL detection, fetches arbitrary content from that attacker-controlled `.store` domain, and immediately passes the response body through `eval(JSON.parse(b))` — a textbook stage-1 loader pattern. The `getPlugin` function is called at module load time with no user trigger required, and a `setTimeout` chains a second payload fetch (`getPluginExten`) 60 seconds later, suggesting a two-stage dropper designed to evade short sandbox analysis windows. The `isPlugin()` function that was originally gating execution on Windows-only was commented out, meaning the loader now runs unconditionally on all platforms. The publisher (`npm-chain-dev1`) is a brand-new account with only two packages, no repository, and a generic outlook email — consistent with a throwaway supply-chain attack account. ENTRY index.js (main: index.js) DESTINATION - 2 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in index.js: "process.platform" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Remote Code Execution in index.js: "eval(JSON.parse(" - Reconstructed Obfuscated URL in index.js: "https://rest-icon-handler.store/icons/103" - Brand New Package PAYLOAD FILES index.js