GCVE-110-OSM-2026-9586

The decoded index.js reveals a front-end license-enforcement / domain-gating script that base64-obfuscates its endpoint URL ('aHR0cHM6Ly9raXJvbi5mZW5peGNvZGVyLmNvbS9kb21haW4v' → https://kiron.fenixcoder.com/domain/) and POSTs location.hostname to it before allowing the page to render. The attacker model is ambiguous: this could be a legitimate commercial DRM widget that checks whether a domain is licensed (the CSS class 'PUL_PBER_GRNZ_PUL_9K2N' suggests a license token), or it could be a hostname-harvesting implant where the remote server gates functionality to encourage adoption while silently collecting deployment domains. The deliberate obfuscation of the C2 URL via multiple atob() calls in a throwaway npm account with zero metadata is a meaningful adversarial signal even if the payload is 'only' hostname data. The package also grants the remote server kill-switch power over any site that embeds it — kiron.fenixcoder.com can wipe the DOM of all consuming sites at will, which is a supply-chain risk regardless of intent. ENTRY index.js (main: index.js) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) OBFUSCATION - Decoded Base64 Content in index.js (x10) - IOCs Found in Deobfuscated Code in index.js - Dynamic Base64 Decoding in index.js: "atob(t)" - Obfuscation (osm-deobfuscator): unknown in index.js - recovered 2 urls, 2 domains, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Platform Detection with Data Collection in index.js: "JSON.stringify({d:location.hos" PAYLOAD FILES index.js