GCVE-110-OSM-2026-9820

This package is a typosquatted/scoped clone of the legitimate node-fetch library (2.7.x version not present in the real package), published by a brand-new account ('dexwilt') with only 2 packages and a disposable-looking email domain (web-library.net). The lib/index.js file contains heavy obfuscator.io obfuscation with control-flow flattening, proxied string array access, and base64 payloads injected into what is otherwise a copy of the legitimate node-fetch source. Deobfuscation recovered 103 IOCs including hardcoded C2 IPs (12.1.1.3, 12.1.1.4) and 50+ short domains following patterns like gh.ac, gh.ae, dY.ac, dY.am etc. — characteristic of a DGA-style C2 domain list hidden in the obfuscated layer — combined with network request capability (http.request) to exfiltrate to those endpoints. The attacker model is a supply-chain implant: ship a convincing clone of a popular HTTP library with an obfuscated payload that beacons to attacker-controlled infrastructure on import. ENTRY lib/index.js (main: lib/index.js) DESTINATION - 52 exfil (custom-c2) - 1 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Network Request in lib/index.es.js: "http.request(" - Network Request in lib/index.js: "http.request(" - Network Request in lib/index.mjs: "http.request(" OBFUSCATION - IOCs Found in Deobfuscated Code in lib/index.js - Obfuscation: augmented proxied array function replacements in lib/index.js - Base64 Encoded Payload in lib/index.js: "'W5hcLhWqW4KsW6jZW47dSSknAh7cQCoKW63cGuhdNwVcKCkMW63cMsuPWQHke2/cHSobW6ZdTmoqiCo..." - Obfuscation: obfuscator.io in lib/index.js - Obfuscation (osm-deobfuscator): unknown in lib/index.js - Obfuscation patterns: stringArrayAccess, controlFlowFlattening in lib/index.js - recovered 2 ipv4, 1 urls, 50 domains, 50 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Dynamic Code Execution in lib/index.es.js: "exec(ct)" PAYLOAD FILES lib/index.js