GCVE-110-OSM-2026-9563

The package 'cors-security' masquerades as an SVG utility but contains a covert remote code execution backdoor. In `src/index.cjs`, the `getPlugin()` function fetches arbitrary code from `https://workconfig.vercel.app` and executes it via `new Function('require', data.toString())(require)` — a classic loader pattern that downloads and runs attacker-controlled payloads with full Node.js `require` access. The attacker model is a supply-chain implant: a convincing-looking SVG utility library with a hidden plugin mechanism that phones home to a custom C2 on Vercel. The publisher account 'thornburg1' has zero prior packages, no repository, and the package description ('zero-dependency SVG utilities') is a deliberate misdirection. The package name 'cors-security' has no relationship to its stated or actual functionality, suggesting typosquatting or namespace confusion as a distribution vector. ENTRY bin/svgcraft.mjs (bin: ./bin/svgcraft.mjs) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in src/index.cjs: "encodeURIComponent(minifySvg(svg" - Data Encoding for Exfiltration in src/index.mjs: "encodeURIComponent(minifySvg(svg" - Network Request in src/index.cjs: "https.get(" ADDITIONAL FINDINGS - Dynamic Code Execution in src/index.cjs: "exec(tag)" PAYLOAD FILES src/index.cjs (+ src/index.mjs)