GCVE-110-OSM-2026-10525

This looks like a deliberate install-time exfiltration package from a throwaway or burner publisher, consistent with a supply-chain attacker targeting npm consumers. The package.json runs `preinstall: node test.js`, and `test.js` touches `os.userInfo()` / `os.hostname()` while sending traffic to a decoded OAST host, which is classic beaconing and environment fingerprinting. The URL dependency on `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.4.tgz` further bypasses registry controls and can pull arbitrary code during install. Publisher history strongly corroborates malicious intent: `whltd4` has a >0.34 malicious ratio and multiple prior malicious packages, so the OSV advisory is supported by the actual code and IOC evidence. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/l..." - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" EXFIL - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Network Request in [ltidisafe] index.js: "http.request(" - System Information Collection in [ltidisafe] test.js: "os.userInfo()" - Suspicious Domain in [ltidisafe] test.js: "oastify.com" OBFUSCATION - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Brand New Package PAYLOAD FILES [ltidisafe] test.js