GCVE-110-OSM-2026-10617

localize-extract@1.0.0 executes a postinstall script that collects host identifiers (os.hostname(), platform, arch, node version, package name, lifecycle event) and POSTs them as JSON to the hardcoded endpoint https://1zrgq9h2.instances.poc.jchunt.top/localize-extract at npm install time. The package name resembles @angular/localize and the tarball references the upstream angular/localize package.json, consistent with a dependency-confusion / typosquat probe. Data leaves the installer's machine to an attacker-chosen host without consent on install. Judge assessment: This is a classic install-time data theft payload aimed at npm consumers: the `postinstall` hook in `package.json` runs `node postinstall.js`, which immediately POSTs host metadata from the installer machine. The code in `postinstall.js` collects `process.env.npm_package_name`, `os.hostname()`, `process.platform`, `process.arch`, `process.version`, and `process.env.npm_lifecycle_event`, then sends it to the hardcoded attacker-controlled endpoint `1zrgq9h2.instances.poc.jchunt.top/localize-extract`. The behavior matches the OSV malware advisory and is consistent with a dependency-confusion / typosquat probe targeting users who install a package named `localize-extract` or mistake it for Angular localization tooling. The attacker model is straightforward: silently fingerprint installations and exfiltrate system identifiers on package install. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in postinstall.js: "process.env.npm_package_name, hostname: os.hostname(), platform: process.platfor..." - System Information Exfiltration in postinstall.js: "os.hostname(), platform: process.platform, arch: process.arch, node: process.ver..." - HTTP Data Exfiltration in postinstall.js: "os.hostname(), platform: process.platform, arch: process.arch, node: process.ver..." - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.hostname()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({ timestamp: new Date().toISOString(), pkg: process.env.npm_packa..." PAYLOAD FILES postinstall.js