GCVE-110-OSM-2026-10253

This package is a credential-stealing install-time loader that targets developers and CI runners: the preinstall/postinstall hooks execute `index.js`, which harvests `process.env`, `.ssh/id_rsa`, `.ssh/id_ed25519`, `.gitconfig`, `.aws/credentials`, and `.env` files, then sends the payload to `webhook.site`. The code uses a detached, silent child process (`spawn(process.execPath, ['-e', src], { detached: true, stdio: 'ignore' })`) with delayed transmission specifically to survive the install window, which is a classic attacker tradecraft for stealthy exfiltration. The attacker model is clear: a supply-chain compromise or typosquat (`@openzeppelin-5/contracts`) aimed at stealing secrets from maintainers and automated build environments. The static score and findings (`encoded-env-exfil`, `credential-theft`, `install-hook-exfil`) are fully corroborated by the actual file content in `index.js` and `package.json`. ENTRY index.js (install-hook: node index.js || true) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json EXFIL - Environment Variable Exfiltration in index.js: "JSON.stringify(process.env)" - Sensitive File Access in index.js: "'.ssh/id_rsa'" - OAST/Interactsh Exfiltration in index.js: "webhook.site" - Git Configuration Access in index.js: ".gitconfig" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn(process.execPath, ['-e', src], { detached: true, stdio: 'ignore' }" - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn(process.execPath, ['-e', src], { detached: true" PAYLOAD FILES index.js