GCVE-110-OSM-2026-10508

axios-fast@1.0.0 is a typosquat of axios whose package.json declares a preinstall lifecycle hook that runs a Node one-liner POSTing JSON.stringify({ nodeEnv: process.env }) to https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/ on npm install. This dumps the installer's full environment (which on developer machines and CI runners typically contains cloud credentials, registry tokens, CI secrets, and API keys) to an attacker-controlled webhook.site collector, with no relation to any legitimate HTTP-client functionality the package name implies. Judge assessment: This is a credential-stealing install-time implant: the package.json preinstall hook runs a Node one-liner that POSTs JSON.stringify({ nodeEnv: process.env }) to a webhook.site collector, which would expose installer's environment secrets on developer machines and CI runners. The attacker model is a typosquatting supply-chain operator abusing the axios-fast name to harvest cloud credentials, registry tokens, and API keys during npm install. The OAST exfiltration finding, the explicit webhook URL in the IOC set, and the preinstall hook together confirm intent rather than a legitimate HTTP client feature. The package's rapid publication pattern and brand-new status further support malicious staging rather than normal library behavior. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "node -e \"" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in package.json: "webhook.site" - Network Request in package.json: "fetch('https:" ADDITIONAL FINDINGS - Brand New Package - Rapid Version Publishing