GCVE-110-OSM-2026-10522

This is a self-described dependency confusion PoC by 'awais0x1 bugcrowd' that nonetheless executes fully functional multi-channel exfiltration on install. The code in index.js runs on preinstall/install/postinstall and performs six distinct exfiltration channels: curl POSTing /etc/passwd contents, base64-encoded DNS nslookup beacon, HTTPS/HTTP POST of full system info (hostname, user, platform, env vars, /etc/passwd contents), ICMP ping callback, proof file written to /tmp, and a Windows PowerShell Invoke-WebRequest — all targeting the OAST endpoint zgj4u5hsj43gjyuvkjmgxrqyjppgd61v.oastify.com. Bug bounty PoC packages that actually exfiltrate /etc/passwd and environment variables to an attacker-controlled OAST endpoint are functionally indistinguishable from malware; the self-labeling does not neutralize the harm. The publisher 'bugkiller0x1' has a 75% malicious package ratio with three other packages already flagged critical in OSM. ENTRY index.js (install-hook: node index.js > /dev/null 2>&1; exit 0) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 2 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - Sensitive File Access in index.js: ""/etc/passwd"" - OAST/Interactsh Exfiltration in index.js: "oastify.com" - System Information Exfiltration in index.js: "os.hostname() } }); req.write(payload); req.end(); } catch (e) { // HTTP fallbac..." - HTTP Data Exfiltration in index.js: "os.hostname(), user: (os.userInfo() || {}).username }); const req = http.request" - Data Encoding for Exfiltration in index.js: "Buffer.from(exfil).toString("base64")" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "oastify.com" OBFUSCATION - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Shell Command Execution in index.js: "require("child_process")" - Platform Detection with Data Collection in index.js: "JSON.stringify({ package: PACKAGE_NAME, hostname: os.hostname(), user: (os" - Suspicious URL Pattern in Template Literal in index.js: "powershell -Command "Invoke-WebRequest -Uri http://zgj4u5hsj43gjyuvkjmgxrqyjppgd..." - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js