GCVE-110-OSM-2026-10495

upload-to-gcp@3.2.1 runs a postinstall lifecycle script on npm install that collects host identifiers (os.hostname(), process.platform, process.arch, Node version, package name, npm lifecycle event) and POSTs them to a hardcoded remote endpoint at https://z5owtt3g.instances.poc.jchunt.top/upload-to-gcp. The destination is a random-looking subdomain not associated with Google Cloud Platform or any documented first-party service, and the transmission occurs automatically at install time with no opt-in and no disclosure. The package name suggests a GCP upload utility, which is inconsistent with the observed beaconing behavior to an unrelated host. Judge assessment: This package is an install-time data exfiltrator: the attacker model is dependency confusion or a malicious publisher shipping a deceptive utility that silently beacons host telemetry during npm install. The `package.json` postinstall hook runs `postinstall.js`, which collects `process.env.npm_package_name`, `os.hostname()`, `process.platform`, `process.arch`, `process.version`, and `process.env.npm_lifecycle_event`, then POSTs them to the hardcoded endpoint `z5owtt3g.instances.poc.jchunt.top/upload-to-gcp`. The code explicitly suppresses errors with `req.on("error", () => {})`, reinforcing that the goal is covert telemetry exfiltration rather than legitimate functionality. The OSV advisory `MAL-2026-14067` is fully corroborated by the actual entrypoint and exfil code, and the minimal metadata plus burner-like shape further support malicious intent. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in postinstall.js: "process.env.npm_package_name, hostname: os.hostname(), platform: process.platfor..." - System Information Exfiltration in postinstall.js: "os.hostname(), platform: process.platform, arch: process.arch, node: process.ver..." - HTTP Data Exfiltration in postinstall.js: "os.hostname(), platform: process.platform, arch: process.arch, node: process.ver..." - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.hostname()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({ timestamp: new Date().toISOString(), pkg: process.env.npm_packa..." PAYLOAD FILES postinstall.js