GCVE-110-OSM-2026-9555

This is a typosquatting package impersonating the legitimate 'postcss' library, published by a brand-new single-package account (brownroger). The entrypoint lib/postcss.js contains legitimate postcss code followed by a whitespace-padded hidden payload that implements a full Ethereum blockchain interaction suite: it uses unicode-escaped strings to hide imports of 'child_process', 'https', and 'http', hardcodes an Ethereum address and then queries multiple Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io), and exfiltrates via e.tx.to — consistent with a cryptocurrency drainer or wallet-targeting attack. The campaign marker 'global["_V"]' is a confirmed PolinRider (DPRK/Lazarus) attribution indicator. The combination of steganographic whitespace padding, 33+ unicode escape sequences hiding critical strings, eval-of-dynamic-content, and confirmed Ethereum address exfiltration leaves no ambiguity about adversarial intent. ENTRY lib/postcss.js (main: ./lib/postcss.js) DESTINATION - 16 exfil (custom-c2, ethereumAddresses) - 1 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/map-generator.js: "Buffer.from(str).toString('base64')" - Network Request in lib/postcss.js: "http.request(" OBFUSCATION - Decoded Unicode Escape Content in lib/postcss.js (x20) - IOCs Found in Deobfuscated Code in lib/postcss.js - Whitespace-Padded Hidden Payload in lib/postcss.js: "; global" - Dynamic Base64 Decoding in lib/postcss.js: "Buffer.from(n,"base64")" - Dynamic Base64 Decoding in lib/previous-map.js: "atob(str)" - Unicode Escape Obfuscation in lib/postcss.js: "\u0068\u0074\u0074\u0070\u0073" - Strings Extracted from Deobfuscated Code in lib/previous-map.js - Obfuscation patterns: unicodeHeavy in lib/postcss.js (+1 more) ADDITIONAL FINDINGS - Global Require Alias in lib/postcss.js: "global['r']=require" - Campaign marker: PolinRider in lib/postcss.js: "global['_V']" - Dynamic Code Execution in lib/postcss.js: "eval(r+" - Brand New Package - Malicious Dependency Detected in package.json PAYLOAD FILES lib/postcss.js