GCVE-110-OSM-2026-10500

Looks like bug-bounty style package. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it collects os.hostname(), os.platform(), os.networkInterfaces(), cwd, uid, the output of `id`, a full process.env dump, /proc/self/environ, a root filesystem listing, and the contents of ~/.npmrc, and specifically reads AWS_CONTAINER_CREDENTIALS_RELATIVE_URI. The collected JSON payload is POSTed via https.request to a hardcoded webhook.site collector at https://webhook.site/22508080-b099-4ec3-8ab7-7354af2886a9/buildenv. ~/.npmrc contains the installer's npm registry auth token, and the AWS ECS credential-endpoint variable exposes the path to fetch task-role AWS credentials; both are installer-owned secrets shipped to an anonymous third-party collector at install time. ENTRY probe.js (install-hook: node probe.js || true) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json EXFIL - Environment Variable Exfiltration in probe.js: "process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI||'none') }; const body=Buffer..." - Sensitive File Access in probe.js: "'/.npmrc'" - OAST/Interactsh Exfiltration in probe.js: "webhook.site" - System Information Exfiltration in probe.js: "os.homedir()+'/.npmrc','utf8').slice(0,600)), ecs:safe(()=>process.env.AWS_CONTA..." - Network Request in probe.js: "https.request(" - System Information Collection in probe.js: "os.hostname()" ADDITIONAL FINDINGS - Shell Command Execution in probe.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES probe.js