GCVE-110-OSM-2026-10524

This looks like a credential-and-environment probing loader from a malicious publisher, not a legitimate gunzip library. The package runs a preinstall hook (`node test.js > /dev/null 2>&1`) and the referenced `test.js` collects `os.userInfo()` and `os.hostname()` before making an HTTP request to an OAST domain, which is a classic attacker model for beaconing and sandbox/host fingerprinting. The URL-based dependency in `package.json` points to an external tarball hosted on `ltidi.storage.googleapis.com`, and the decoded IOC confirms outbound contact. The publisher `whltd4` already has multiple malicious packages and a malicious ratio above 0.34, so the metadata strongly corroborates active supply-chain abuse. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/l..." - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" EXFIL - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Network Request in [ltidisafe] index.js: "http.request(" - System Information Collection in [ltidisafe] test.js: "os.userInfo()" - Suspicious Domain in [ltidisafe] test.js: "oastify.com" OBFUSCATION - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Brand New Package PAYLOAD FILES [ltidisafe] test.js