GCVE-110-OSM-2026-9645

The package 'nagixjs' executes on install via a postinstall hook ('node test.js'), which calls functions from index.js — a heavily obfuscated file using obfuscator.io-style hex variable names (_0x pattern, 117 occurrences) and unicode escape sequences (122 occurrences). Deobfuscation recovered hidden IOCs: a hardcoded attacker-controlled IP with two C2 endpoints, consistent with a reconnaissance/data-collection implant. The decoded content also reveals use of 'child_process', 'execSync', and 'readFile', indicating shell execution and filesystem access, likely to exfiltrate environment data or credentials to the C2. The attacker model is a supply-chain implant that executes silently at install time, collects host/environment data, and beacons to a remote server — consistent with Contagious Interview-style or generic npm-based stealer campaigns. ENTRY test.js (install-hook: node test.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Decoded Unicode Escape Content in index.js (x76) - IOCs Found in Deobfuscated Code in index.js - Unicode Escape Obfuscation in index.js: "\u0065\u0078\u0065\u0063\u0053\u0079\u006E\u0063" - Obfuscation (osm-deobfuscator): unknown in index.js - Obfuscation patterns: hexVariables, unicodeHeavy in index.js - recovered 4 urls, 1 ips, 1 ipv4 from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in index.js: "execSync(" PAYLOAD FILES index.js