GCVE-110-OSM-2026-10225

This package is a credential-and-system-data exfiltration loader triggered at install time, which is consistent with a supply-chain attacker model targeting npm consumers. The `preinstall` hook runs `node index.js`, and `index.js` invokes `child_process.exec` to curl an OAST endpoint while stuffing `whoami`, `hostname`, `/etc/passwd`, `/etc/hosts`, `id`, and even `/etc/shadow` into the request. The package exfils to a oast.me endpoint and the base64-wrapped command substitution show deliberate out-of-band exfiltration rather than any legitimate telemetry. The minimal metadata and absence of a repository further fit a throwaway malicious package profile. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: ".oast.me" - Suspicious Domain in index.js: "oast.me" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" PAYLOAD FILES index.js