GCVE-110-OSM-2026-10478

On npm install, preinstall.js collects hostname, username, platform, cwd, and the full process.env and POSTs the payload over HTTPS (with TLS verification disabled via rejectUnauthorized:false) to a hardcoded bare IP at 209.99.185.109/preinstall. A postinstall path additionally reads.env,../.env,../../.env,.npmrc, and package.json from the install directory, captures whoami/id output and the full process.env, and POSTs the bundle to 209.99.185.109/postinstall with TLS verification disabled..npmrc contains npm _authToken values and.env typically holds CI/CD secrets and cloud credentials. A bundled PowerShell artifact references publishing under npm account oxy12@proton.me and the package name and 99.0.0 version resemble a typosquat / dependency-confusion lure targeting an internal Alelo utility, with no legitimate functionality shipped. Judge assessment: This package is consistent with a credential-and-system-data stealer operated by a dependency-confusion or typosquat attacker model targeting an internal Alelo utility: the entrypoint `preinstall.js` runs on install and POSTs `hostname`, `user`, `platform`, `cwd`, and the full `process.env` to `alelo1786663101.requestcatcher.com`. The `index.js` postinstall path deepens the theft by reading `.env`, `.npmrc`, `../.env`, `../../.env`, and `package.json`, capturing `whoami`, and exfiltrating everything over HTTPS, which is classic third-party package compromise behavior. The combination of `preinstall`/`postinstall` hooks, `child_process.execSync`, and plaintext exfil IOC `alelo1786663101.requestcatcher.com` is not plausibly legitimate for an “internal utilities” package. The new account `contawpp2026id` and brand-new versioning further support malicious publication intent rather than ordinary library behavior. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env, timestamp: new Date().toISOString() }; const req = https.request({ ..." - Payload Download from Paste Service in index.js: "requestcatcher.com" - System Information Exfiltration in preinstall.js: "os.hostname(), user: os.userInfo().username, platform: os.platform(), cwd: proce..." - HTTP Data Exfiltration in preinstall.js: "os.userInfo().username, platform: os.platform(), cwd: process.cwd(), env: proces..." - Payload Download from Paste Service in preinstall.js: "requestcatcher.com" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" - Network Request in preinstall.js: "https.request(" (+1 more) ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js