GCVE-110-OSM-2026-10248

This is a dependency-confusion canary package that nevertheless contains a real install-time exfiltration payload: `package.json` runs `node canary.js` on postinstall, and `canary.js` POSTs host, cwd, username, and selected environment variables to an OAST endpoint. The attacker model is credential and environment harvesting from developer or CI machines via a malicious npm package, using an oastify.com address and `xxxxx.oast.fun` as outbound collection points. Description says "SECURITY POC — dependency confusion validation. DO NOT INSTALL" ENTRY canary.js (install-hook: node canary.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in canary.js: "process.env.CI || null, NODE_ENV: process.env.NODE_ENV || null } }); const req =..." - OAST/Interactsh Exfiltration in canary.js: ".oast.fun" - System Information Exfiltration in canary.js: "JSON.stringify({ host: require('os').hostname(), cwd: process.cwd(), user: requi..." - HTTP Data Exfiltration in canary.js: "process.cwd(), user: require('os').userInfo().username, env: { CI: process.env.C..." - Network Request in canary.js: "http.request(" - Suspicious Domain in canary.js: "oastify.com" ADDITIONAL FINDINGS - Platform Detection with Data Collection in canary.js: "JSON.stringify({ host: require('os').hostname(), cwd: process.cwd(), user: requi..." - Very New NPM Publisher Account PAYLOAD FILES canary.js