GCVE-110-OSM-2026-10572

This looks like a supply-chain implant intended to run arbitrary code on install and phone home to an attacker-controlled host. The package declares a `postinstall` hook (`node scripts/bootstrap.js`), and that script combines `child_process` execution with persistence attempts (`crontab -`, `.bashrc`) plus collection of `os.userInfo()`, `os.hostname()`, and `.gitconfig`, which is consistent with a hostile attacker model stealing developer identity and establishing persistence. The hardcoded `http://159.75.160.206` endpoint and the recovered exfil classifications on `src-ssrf.bytedance.net`/`159.75.160.206` reinforce that this is not just diagnostics code, despite the benign UUID/MD5 helpers in the dist files. The OSV MAL-2026-14116 advisory also matches the actual install-time behavior observed here, so I would submit this as malicious. ENTRY - Install Hook Executes Local JS File in package.json: ""postinstall": "node scripts/bootstrap.js"" PERSISTENCE - Cron Job Persistence in scripts/bootstrap.js: "crontab -" - Startup Persistence in scripts/bootstrap.js: ".bashrc" DESTINATION - 12 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in dist/commonjs-browser/md5.js: "encodeURIComponent(bytes)); // UTF8 escape" - Data Encoding for Exfiltration in dist/commonjs-browser/sha1.js: "encodeURIComponent(bytes)); // UTF8 escape" - Data Encoding for Exfiltration in dist/commonjs-browser/v35.js: "encodeURIComponent(str)); // UTF8 escape" - Data Encoding for Exfiltration in dist/esm-browser/md5.js: "encodeURIComponent(bytes)); // UTF8 escape" - Data Encoding for Exfiltration in dist/esm-browser/sha1.js: "encodeURIComponent(bytes)); // UTF8 escape" - Data Encoding for Exfiltration in dist/esm-browser/v35.js: "encodeURIComponent(str)); // UTF8 escape" - Data Encoding for Exfiltration in dist/esm-node/v35.js: "encodeURIComponent(str)); // UTF8 escape" - Data Encoding for Exfiltration in dist/md5-browser.js: "encodeURIComponent(bytes)); // UTF8 escape" (+5 more) ADDITIONAL FINDINGS - Shell Command Execution in scripts/bootstrap.js: "require('child_process')" - XOR-Encoded String Arrays in scripts/bootstrap.js: "var A=[49,53,57,46,55,53,46,49,54,48,46,50,48,54]" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES scripts/bootstrap.js