GCVE-110-OSM-2026-10230

This looks like an install-time credential/exfiltration implant aimed at a Discord webhook operated by the attacker, not a normal package diagnostic tool. The postinstall hook runs `node index.js`, and `index.js` builds a JSON payload containing `callerFile`, `node`, and `platform` before sending it with `https.request` to `https://discord.com/api/webhooks/...` / `discordapp.com`, which is classic webhook-based exfiltration. The package also has burner-like metadata (`missing-description`, `no-repository`, `metadata-minimal`) and the hardcoded package name mismatch `whs4_typo` suggests deliberate typosquat/cover traffic rather than legitimate functionality. Attacker model: a malicious npm publisher harvesting install-time host/path fingerprints from victims and relaying them to a Discord C2 channel. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.homedir()" PAYLOAD FILES index.js