GCVE-110-OSM-2026-10507

The package's preinstall script (preinstall.js) collects hostname, username, platform, current working directory, and the full process.env, then POSTs the JSON payload to https://209.99.185.109/preinstall with TLS verification disabled. The postinstall path (index.js) additionally reads local credential files (.env,.npmrc, package.json,../.env,../../.env), captures process.env, runs whoami/id via child_process, and POSTs the aggregated data to https://209.99.185.109/postinstall, also with rejectUnauthorized:false. Both endpoints are a bare IPv4 address with no association to a public publisher..npmrc typically contains npm auth tokens and.env commonly contains cloud/API credentials, so the transmitted data is credential-grade. Package metadata (version 99.0.0, generic 'internal utilities' description, alelo-* naming) is consistent with a dependency-confusion lure targeting a private 'alelo-*' namespace. Judge assessment: This is a clear credential-and-environment theft package aimed at a dependency-confusion or typosquatting victim using the private-looking "alelo-*" namespace. The install hook in `preinstall.js` collects `os.hostname()`, `os.userInfo().username`, `os.platform()`, `process.cwd()`, and the full `process.env`, then POSTs that data to an attacker-controlled url; `index.js` goes further by reading `.env`, `.npmrc`, `../.env`, and `../../.env`, running `whoami`, and exfiltrating the results. The attacker model is a burner publisher on a fresh npm account (`contawpp2026id`) using `preinstall`/`postinstall` hooks to steal secrets from installed environments. The OSV advisory is fully corroborated by the actual code and the plaintext exfil IOC, so this should be treated as confirmed malicious. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env, timestamp: new Date().toISOString() }; const req = https.request({ ..." - Payload Download from Paste Service in index.js: "requestcatcher.com" - System Information Exfiltration in preinstall.js: "os.hostname(), user: os.userInfo().username, platform: os.platform(), cwd: proce..." - HTTP Data Exfiltration in preinstall.js: "os.userInfo().username, platform: os.platform(), cwd: process.cwd(), env: proces..." - Payload Download from Paste Service in preinstall.js: "requestcatcher.com" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" - Network Request in preinstall.js: "https.request(" (+1 more) ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Very New NPM Publisher Account PAYLOAD FILES preinstall.js