GCVE-110-OSM-2026-10611

On npm install, the package's postinstall lifecycle script collects host identifiers (os.hostname(), platform, arch, Node.js version, package name, lifecycle event) and POSTs them as JSON to a hardcoded non-first-party endpoint at https://e14giapf.instances.poc.jchunt.top/karma-proxy. The beacon fires unconditionally on every install, with no user opt-in, no configuration, and no disclosure in the package's advertised purpose. The destination is an author-controlled subdomain unrelated to any npm registry or vendor infrastructure. Judge assessment: This is an install-time data-theft implant: the package's postinstall hook runs unconditionally and sends host metadata to a hardcoded attacker-controlled endpoint, matching the attacker model of dependency-confusion or supply-chain telemetry theft. In `postinstall.js`, the code gathers `process.env.npm_package_name`, `os.hostname()`, `process.platform`, `process.arch`, `process.version`, and `process.env.npm_lifecycle_event`, then POSTs them via `https.request` to `e14giapf.instances.poc.jchunt.top/karma-proxy`. The custom C2 domain is recovered in plaintext and classified as exfil, and the OSV advisory `MAL-2026-14267` corroborates the same unconditional beacon behavior. The package metadata is also burner-like (`author: r00tdaddy`, no description, no repository), which strengthens the supply-chain compromise assessment. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in postinstall.js: "process.env.npm_package_name, hostname: os.hostname(), platform: process.platfor..." - System Information Exfiltration in postinstall.js: "os.hostname(), platform: process.platform, arch: process.arch, node: process.ver..." - HTTP Data Exfiltration in postinstall.js: "os.hostname(), platform: process.platform, arch: process.arch, node: process.ver..." - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.hostname()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({ timestamp: new Date().toISOString(), pkg: process.env.npm_packa..." PAYLOAD FILES postinstall.js