GCVE-110-OSM-2026-10386

This looks like a dependency-confusion or burner-package exfiltration implant: the install hook runs `postinstall.js`, which immediately posts JSON containing `process.env.npm_package_name`, `os.hostname()`, `process.platform`, `process.arch`, `process.version`, and `process.env.npm_lifecycle_event` to a hardcoded custom C2 domain. The attacker model is straightforward—collect host fingerprinting on install and ship it off to an attacker-controlled endpoint without user interaction, which is not legitimate package behaviour. The empty metadata, no repository, and minimal author footprint reinforce that this is a throwaway package built to run on victim machines. There is no plausible benign explanation for the combination of `postinstall` execution plus environment/system-info exfiltration to a plaintext-controlled endpoint. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in postinstall.js: "process.env.npm_package_name, hostname: os.hostname(), platform: process.platfor..." - System Information Exfiltration in postinstall.js: "os.hostname(), platform: process.platform, arch: process.arch, node: process.ver..." - HTTP Data Exfiltration in postinstall.js: "os.hostname(), platform: process.platform, arch: process.arch, node: process.ver..." - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.hostname()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({ timestamp: new Date().toISOString(), pkg: process.env.npm_packa..." PAYLOAD FILES postinstall.js