GCVE-110-OSM-2026-10503

This appears to be a security researcher/bug-bounty style PoC dependency confusion pacakge. The package exfiltrates user and system data, including /etc/passwd to a pipedream endpoint controlled by the author. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Decoded Hex String Content in preinstall.json - Base64 Encoded Payload in preinstall.json: ""6375726c2068747470733a2f2f656f757366743867666c616d6d39312e6d2e70697065647265616..." - recovered 1 urls, 1 domains, 1 paths from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in preinstall.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES preinstall.json