GCVE-110-OSM-2026-10612

package.json declares a postinstall hook that runs index.js on install. The script collects the installer's hostname, full process.env, platform info, output of whoami/uname/id/ps aux, cwd, package.json, node_modules listing, /etc/passwd, /etc/shadow, ~/.npmrc, and ~/.npm/_logs, and POSTs the collected data over plain HTTP to a hardcoded oastify.com (Burp Collaborator) subdomain. The package presents itself as a netbsd-x64 esbuild build, which does not match the observed behavior. The read of ~/.npmrc exposes any npm auth tokens present on the installer host, and /etc/shadow read attempts to exfiltrate local password hashes. Judge assessment: This is an install-time credential and system-data stealer: the attacker model is a package maintainer or compromised publisher using the npm postinstall hook to harvest host secrets from installers. The `package.json` `postinstall: "node index.js"` executes code immediately, and `index.js` exfiltrates `process.env`, `os.hostname()`, `os.platform()`, `whoami`, `uname -a`, `ps aux`, `package.json`, `node_modules`, `~/.npmrc`, and `~/.npm/_logs` to a hardcoded `lodvia5r2wvo8xwizrcusy13yu4msdg2.oastify.com` endpoint over plain HTTP. It also attempts to read `/etc/passwd` and `/etc/shadow`, which is classic local credential theft and system reconnaissance, not legitimate package behavior. The OSV advisory MAL-2026-14186 is fully corroborated by the actual entrypoint content and IOC classification. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: "oastify.com" - Network Request in index.js: "http.request(" - System Information Collection in index.js: "os.hostname()" - Suspicious Domain in index.js: "oastify.com" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" PAYLOAD FILES index.js