GCVE-110-OSM-2026-10384

This package is consistent with a credential-and-environment probing install-time loader operated by a hostile publisher account. The preinstall hook runs `node test.js`, which collects `os.userInfo()` and `os.hostname()` and makes an HTTP request to a recovered OAST domain indicating exfiltration or callback confirmation. The URL-based dependency on bypasses registry trust and, together with the publisher's prior malicious packages and 0.368 malicious ratio, matches a supply-chain attacker model rather than a legitimate package. There is no credible benign explanation for the combination of `installHooks`, `oast-exfiltration`, and `publisher-has-malicious-packages` in a brand-new, minimally described package. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/l..." - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" EXFIL - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Network Request in [ltidisafe] index.js: "http.request(" - System Information Collection in [ltidisafe] test.js: "os.userInfo()" - Suspicious Domain in [ltidisafe] test.js: "oastify.com" OBFUSCATION - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Brand New Package PAYLOAD FILES [ltidisafe] test.js