GCVE-110-OSM-2026-9803

The entrypoint file `dist/module.js` executed on postinstall contains an unambiguous remote-code-execution loader. This fetches arbitrary code from a remote endpoint at install time and executes it with full Node.js `require` access, giving the attacker unrestricted code execution on any victim machine that installs the package. The attacker model is a supply-chain RCE stager disguised as a rollup polyfill utility. The large `dist/es/polyfills.js` and `dist/polyfills.js` files are legitimate browser polyfill bundles (vm-browserify, buffer-es6, pako, etc.) used to pad the package and generate scanner noise — the IOC classifications for those files are all false positives from embedded license/author metadata. The confirmed malicious signals are the postinstall hook, the `dist/module.js` loader, the known-malicious `debug` dependency, and the brand-new publisher `knysh7` with zero prior packages. ENTRY dist/module.js (install-hook: node dist/module.js) - Install Hook Executes Local JS File in package.json DESTINATION - 66 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in dist/es/polyfills.js: "encodeURIComponent(stringifyPrimitive(k)) + eq;\n if (isArray(obj[k])) {\n retur..." - Dynamic C2 Endpoint Construction in dist/es/polyfills.js: "function blobConstructor() {\n if (typeof _blobConstructor !== 'undefined') {\n ..." - Data Encoding for Exfiltration in dist/polyfills.js: "encodeURIComponent(stringifyPrimitive(k)) + eq;\n if (isArray(obj[k])) {\n retur..." - Dynamic C2 Endpoint Construction in dist/polyfills.js: "function blobConstructor() {\n if (typeof _blobConstructor !== 'undefined') {\n ..." - Network Request in dist/module.js: "https.get(" OBFUSCATION - Obfuscation patterns: charCodeArrayBuild, charCodeChain in dist/es/polyfills.js - Obfuscation patterns: charCodeArrayBuild, charCodeChain in dist/polyfills.js ADDITIONAL FINDINGS - Dynamic Code Execution in dist/es/polyfills.js: "eval(code)" - XOR-Encoded String Arrays in dist/es/polyfills.js: "var bl_order = [16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15..." - Malicious Dependency Detected in package.json PAYLOAD FILES dist/es/polyfills.js (+ dist/polyfills.js)