GCVE-110-OSM-2026-10512

package.json declares a postinstall script that automatically runs on npm install and fetches AWS ECS container task metadata via the ECS_CONTAINER_METADATA_URI_V4 endpoint (task ARN, container names, image names), then POSTs the collected data to a hardcoded ngrok tunnel at https://mourner-slot-explicit.ngrok-free.dev using curl. The postinstall also inspects the container image name for substrings matching known security research operators (twbray, packagehound, wiz, oss-dynamic) and labels the payload accordingly, indicating deliberate sandbox and analyst fingerprinting. The destination is an anonymous ngrok tunnel unrelated to any legitimate publisher infrastructure, and the collected data reveals installer-side CI/build/container environment details to a third party. Judge assessment: This is consistent with a malicious npm install-time collector aimed at harvesting container/CI metadata and exfiltrating it to an attacker-controlled C2. The hardcoded ngrok tunnel is classified as `c2`, and the package uses a `postinstall` hook plus `require('child_process')`, which fits automatic execution on install. The OSV advisory aligns with the findings: it describes ECS task metadata collection from `ECS_CONTAINER_METADATA_URI_V4` and POSTing it out, plus fingerprinting logic for security researchers, which is a clear attacker model. The brand-new package and very new publisher account reinforce that this is a throwaway delivery vehicle rather than a legitimate library. ENTRY - Postinstall Script in package.json: ""postinstall": "node -e \"" DESTINATION - 2 c2 (urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Shell Command Execution in package.json: "require('child_process')" - Ngrok Tunneling Service in package.json: "ngrok-free.dev" - Brand New Package - Very New NPM Publisher Account