OpenSourceMalware verified a new npm package, homestack-cheer, as a Magento and Stripe payment-card skimmer using deliberate dual-entrypoint smuggling. The package's main UMD entry runs a benign hello-world greet library, while its ESM entrypoints — src/index.js and src/env_load.js — each execute new Function(atob('<~180KB base64>')), decoding multi-layer obfuscated payloads at runtime. The decoded function, qwdsc(), harvests card number, expiry and CVV, billing address, email address and user agent into a JSON object for exfiltration. The record is rated critical and carries OSV advisory MAL-2026-16333; OSM first recorded it on 21 September and records the affected version as all, so the version check is the consumer's to make against their own dependency graph. The technique is worth noting separately from the package: an entry point that a reviewer or a scanner inspects will show clean code, and the payload only exists after Base64 decoding at runtime, which defeats the static review most teams rely on for small utility dependencies. OSM's watch added it as one of 68 newly archived records in the 22 September harvest, alongside a cluster of Tailwind-impersonating and chai-named packages already tied to DPRK-nexus campaigns by the same pipeline's tagging.

• Source article