GCVE-110-OSM-2026-10759

price-scripping-js@1.1.2 runs `node dist/postinstall.js` as its npm postinstall script. That entry point resolves the installing project's root via `process.env.INIT_CWD?? process.cwd()`, reads the project's `.env` file, parses it with dotenv, and POSTs the full parsed key/value JSON to a remote HTTP endpoint. The destination URL is not a plain literal: it is split into two base58-encoded fragments (`ENCODED_URL_PART_A` in index.js, `ENCODED_URL_PART_B` in cli.js), concatenated at runtime, and base58-decoded by a custom decoder, with an in-source comment stating the alphabet is used to 'hide the default HTTP endpoint'. Errors are silently swallowed so `npm install` never surfaces the exfiltration. The package advertises itself in package.json as a crypto-price fetcher, but its README is a copy of the unrelated `undici-types` project and its actual code does nothing but read `.env` and upload it. `.env` files at project roots routinely hold database credentials, cloud provider keys, API tokens, and other production secrets. Judge assessment: This is a credential-theft and exfiltration package masquerading as a crypto-price fetcher: the postinstall entry point `dist/postinstall.js` runs on install and immediately calls `prices()`, while the advisory describes that code reading the installing project’s `.env` and POSTing it to a remote HTTP endpoint. The attacker model is a supply-chain opportunist targeting npm consumers to steal secrets from project roots, especially `.env` files that commonly contain API keys and cloud credentials. The evidence is reinforced by the hidden endpoint construction via base58-encoded fragments and the deliberate `npm install` failure suppression, which are classic concealment tactics rather than normal library behavior. The very new publisher account `fgrfgre` and single-version, no-repository metadata further support that this is an intentionally planted malicious package. ENTRY dist/postinstall.js (install-hook: node dist/postinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - HTTP Data Exfiltration in dist/index.js: "fetch(getDefaultEncoded()); const DEFAULT_TIMEOUT_MS = 10000; function resolveDe..." ADDITIONAL FINDINGS - Very New NPM Publisher Account PAYLOAD FILES dist/index.js