GCVE-110-OSM-2026-10395

This package is clearly designed to execute on install via the attacker-controlled npm preinstall hook `node preinstall.js`, and that entrypoint makes a live HTTPS request to a `webhook.site` callback URL. The author explicitly states the package's purpose is to demonstrate install-hook network activity, and the code sends only a GET with a custom User-Agent, not machine secrets or filesystem data. Because the behavior is intentionally benign-looking telemetry but still a real exfil-style webhook callback from an install hook, I would treat it as suspicious rather than outright malicious, likely a proof-of-concept or callback demo by a test actor. The likely attacker model is a package maintainer demonstrating or testing callback reachability, not credential theft or payload delivery. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 c2 (urls) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: "webhook.site" - OAST/Interactsh Exfiltration in package.json: "webhook.site" - OAST/Interactsh Exfiltration in preinstall.js: "webhook.site" - Network Request in preinstall.js: "https.get(" PAYLOAD FILES preinstall.js (+ index.js)