GCVE-110-OSM-2026-9551

This package is a trojanized Tailwind CSS scrollbar plugin attributed to the DPRK/Lazarus nullreceiver and PolinRider campaigns. The entrypoint dist/index.js contains a legitimate-looking CSS utility export immediately followed by eval(atob(...)), which decodes to a multi-stage payload: it sets global.i='A10-npm-handy' (the campaign marker), imports http/https/child_process/zlib, then performs Ethereum blockchain lookups against multiple public RPC endpoints to extract an attacker-controlled IP address embedded in a transaction's 'to' field. This IP is then used as a C2 host to fetch and eval/spawn additional payloads via gc()/rl() functions using XOR-decrypted responses. The Ethereum address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a acts as a dead-drop resolver, and the detached spawn call ensures persistence of the secondary payload. The publisher account 'sun117' is brand new (1 day old) with a single package, consistent with a throwaway account used in DPRK supply chain operations. ENTRY dist/index.js (main: dist/index.js) DESTINATION - 1 exfil (ethereumAddresses) - 6 fetched-payload (deobfuscated) (values recorded in verified_iocs) OBFUSCATION - Decoded Base64 Content in dist/index.js - IOCs Found in Deobfuscated Code in dist/index.js - Dynamic Base64 Decoding in dist/index.js: "eval(atob" - Base64 Encoded Payload in dist/index.js: ""Z2xvYmFsLmk9IkExMC1ucG0taGFuZHkiO2dsb2JhbC5yPXJlcXVpcmU7dHlwZW9mIG1vZHVsZT09PSJ..." - Obfuscation (osm-deobfuscator): unknown in dist/index.js - recovered 13 urls, 1 ips, 11 domains, 1 ipv4, 1 ethereumAddresses, 6 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Base64 Decoded Eval in dist/index.js: "eval(atob(" - Campaign marker: nullreceiver in [deobfuscated] dist/index.js: "A10-npm" - Campaign marker: PolinRider in [deobfuscated] dist/index.js: "global['_V']" - Very New NPM Publisher Account PAYLOAD FILES dist/index.js