GCVE-110-OSM-2026-10362

This looks like a credential-and-environment theft implant disguised as a bug-bounty canary: the install hook runs `canary.js`, which gathers host identity, filesystem listings, npm/AWS credential presence, and IMDS reachability, then sends everything off-box. The attacker model is a supply-chain package that harvests cloud metadata and local secrets from the build/install environment, which is consistent with the hardcoded exfil destination `whstool.brkd.no` and the IMDS probe to `169.254.169.254`. The comments claiming "Authorized bug-bounty canary" do not match the behavior: `fs.readFileSync` on `~/.npmrc` and `/root/.aws/credentials`, `execSync('id')`, and `http.get()` to a custom C2 are all classic reconnaissance/exfil steps. The minimal metadata and install-time execution reinforce that this is a malicious burner package intended to run during installation and report sensitive environment data. ENTRY canary.js (install-hook: node canary.js install) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in canary.js: "http.get(" - System Information Collection in canary.js: "os.hostname()" - http://169.254.169.254/latest/meta-data/iam/security-credentials/ ADDITIONAL FINDINGS - Shell Command Execution in canary.js: "require('child_process')" PAYLOAD FILES canary.js