GCVE-110-OSM-2026-10367

This is a classic install-time trojan that uses the npm preinstall hook in `package.json` to run `scripts/check-env.js`, then performs host reconnaissance and sends it to a webhook.site C2 endpoint. The payload enumerates `~/.ssh`, `crontab -l`, `/etc/passwd`, environment secrets, network state, and system services, then conditionally executes attacker-supplied `cfg.cmd` or downloads and runs a remote binary via `cfg.url`, matching an attacker model of credential theft plus remote code execution. The use of `child_process.execSync`, `http(s)`-style exfiltration through `https://webhook.site/0c5803fc-bdd6-4dd0-8c57-68ee0cabac29`, and cron/persistence checks is not consistent with a legitimate helper library. Minimal metadata and the lack of a source repository further support a throwaway malicious package. ENTRY scripts/check-env.js (install-hook: node scripts/check-env.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Cron Job Persistence in scripts/check-env.js: "crontab -" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in scripts/check-env.js: "webhook.site" - System Information Collection in index.js: "os.homedir()" - System Information Collection in lib/config.js: "os.homedir()" - Network Request in lib/transport.js: "http.get(" - System Information Collection in scripts/check-env.js: "os.hostname()" ADDITIONAL FINDINGS - Shell Command Execution in lib/transport.js: "require('child_process')" - Dynamic Code Execution in scripts/check-env.js: "exec(cmd)" PAYLOAD FILES scripts/check-env.js