GCVE-110-OSM-2026-10033

This is consistent with a dependency-confusion implant designed to run on install and exfiltrate host data to an attacker-controlled collector. The package uses a `postinstall` hook (`node index.js`) and the entrypoint reads `os.userInfo().username`, `process.cwd()`, `os.hostname()`, and a local IPv4 address before sending a JSON payload over `https.request` to a plaintext `webhook.site` URL. The attacker model is straightforward: a malicious publisher uploaded version `99.9.9` to outrank an internal package name, then harvests environment and system metadata when the package is installed. The presence of `env-exfiltration`, `oast-exfiltration`, and the recovered custom-C2 IOC `https://webhook.site/452b7e38-183d-4652-847d-0f2fa05b9389` makes the malicious intent unambiguous. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in index.js: "process.env.INIT_CMD || process.cwd(), hostname: os.hostname(), ip: localIP(), c..." - OAST/Interactsh Exfiltration in index.js: "webhook.site" - System Information Exfiltration in index.js: "os.userInfo().username, cwd: process.env.INIT_CMD || process.cwd(), hostname: os..." - HTTP Data Exfiltration in index.js: "os.userInfo().username, cwd: process.env.INIT_CMD || process.cwd(), hostname: os..." - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in index.js: "JSON.stringify({ user: os.userInfo().username, cwd: process.env.INIT_CMD || proc..." PAYLOAD FILES index.js