GCVE-110-OSM-2026-9820

This package is a typosquatted/scoped clone of the legitimate node-fetch library (2.7.x version not present in the real package), published by a brand-new account ('dexwilt') with only 2 packages and a disposable-looking email domain (web-library.net). The lib/index.js file contains heavy obfuscator.io obfuscation with control-flow flattening, proxied string array access, and base64 payloads injected into what is otherwise a copy of the legitimate node-fetch source. . ENTRY lib/index.js (main: lib/index.js) DESTINATION - 52 exfil (custom-c2) - 1 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Network Request in lib/index.es.js: "http.request(" - Network Request in lib/index.js: "http.request(" - Network Request in lib/index.mjs: "http.request(" OBFUSCATION - IOCs Found in Deobfuscated Code in lib/index.js - Obfuscation: augmented proxied array function replacements in lib/index.js - Base64 Encoded Payload in lib/index.js: "'W5hcLhWqW4KsW6jZW47dSSknAh7cQCoKW63cGuhdNwVcKCkMW63cMsuPWQHke2/cHSobW6ZdTmoqiCo..." - Obfuscation: obfuscator.io in lib/index.js - Obfuscation (osm-deobfuscator): unknown in lib/index.js - Obfuscation patterns: stringArrayAccess, controlFlowFlattening in lib/index.js - recovered 2 ipv4, 1 urls, 50 domains, 50 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Dynamic Code Execution in lib/index.es.js: "exec(ct)" PAYLOAD FILES lib/index.js