GCVE-110-OSM-2026-10684

On `npm install`, the package's postinstall lifecycle script collects installer host identifiers (hostname, platform, arch, node version, package name, timestamp, npm lifecycle event) and POSTs them as JSON to the hardcoded host gigww0v7.instances.poc.jchunt.top at path /localize-translate. The destination is a non-registry, author-controlled endpoint that the installer never opted into, and the beacon fires automatically at install time on every host that installs the package. The collected fields are limited to host identity (no credential, filesystem, or environment scraping is present), but the beacon is unconditional, undisclosed, and directed to a third-party host — the shape of an install-time reconnaissance callback rather than legitimate telemetry. Judge assessment: This looks like an install-time reconnaissance beacon intended to exfiltrate host identity data from every npm install, not a legitimate library behavior. The package’s `postinstall` hook runs `node postinstall.js`, which immediately POSTs JSON containing `os.hostname()`, `process.platform`, `process.arch`, `process.version`, `process.env.npm_package_name`, and `process.env.npm_lifecycle_event` to the hardcoded custom-C2 host `gigww0v7.instances.poc.jchunt.top/localize-translate`. The attacker model is a dependency-confusion or burner-package operator harvesting installer metadata at scale, and the unconditional beacon plus minimal metadata (`r00tdaddy`, no repo/description) fits that pattern. The OSV MAL advisory is corroborated by the actual entrypoint and exfil code, so this is not a false positive. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in postinstall.js: "process.env.npm_package_name, hostname: os.hostname(), platform: process.platfor..." - System Information Exfiltration in postinstall.js: "os.hostname(), platform: process.platform, arch: process.arch, node: process.ver..." - HTTP Data Exfiltration in postinstall.js: "os.hostname(), platform: process.platform, arch: process.arch, node: process.ver..." - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.hostname()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({ timestamp: new Date().toISOString(), pkg: process.env.npm_packa..." PAYLOAD FILES postinstall.js