GCVE-110-OSM-2026-10365

This package is a dependency-confusion style dropper aimed at exfiltrating host identity during install: the attacker model is a malicious npm publisher using a preinstall hook to fingerprint and beacon victim machines. The `package.json` preinstall entry runs `index.js`, which collects `whoami`, `os.hostname()`, `os.platform()`, `process.cwd()`, and `os.homedir()` before sending them to the plaintext OAST domain `5f8a1ed70fb7761d678agw9bapayyyyyb.oast.site` via `https.request()`. The code also performs a DNS lookup fallback with a hostname constructed from `data.user` and `data.hostname`, which is consistent with covert exfiltration rather than legitimate telemetry. The minimal metadata and `DepConf-PoC/@assetshop/verify-cli` user-agent further reinforce that this is a proof-of-concept malicious package, not a normal library. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: "oast.site" - Data Encoding for Exfiltration in index.js: "encodeURIComponent(data.user)}/${encodeURIComponent(data.hostname)}/?p=${encodeU..." - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.hostname()" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" PAYLOAD FILES index.js