GCVE-110-OSM-2026-10366

This package is a credential-and-system data exfiltration implant that executes on install: `package.json` runs `node index.js` in a `preinstall` hook, and `index.js` shells out with `child_process.exec` to POST to an OAST endpoint. The payload explicitly reads `/etc/passwd`, `/etc/hosts`, `id`, and conditionally `/etc/shadow`, then base64-encodes the results and sends them to `http://5f8a1ed70fb7761d678agw9bucryyyyyb.oast.site/.../$(whoami)/$(hostname)/`. The attacker model is clear: compromise of developer or CI machines by harvesting local account and host data and beaconing it out-of-band during package installation. Minimal metadata and the throwaway `verify-cli@99.0.0` shape reinforce that this is not a legitimate CLI but a malicious install-time loader. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: "oast.site" - Suspicious Domain in index.js: "http://5f8a1ed70fb7761d678agw9bucryyyyyb.oast" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" PAYLOAD FILES index.js