GCVE-110-OSM-2026-10827

lumen-pages-community@9.9.9 declares a postinstall hook (`node dc.js`) that runs automatically on `npm install`. dc.js collects the installer's hostname, username, current working directory, platform, Node version, CI environment variable, and npm user-agent, then issues an HTTPS GET to a hardcoded webhook.site collector URL (https://webhook.site/b00492c6-27ba-4ea0-a9cb-dd50b3770250/dc) with those fields as query parameters. The package name plus a 9.9.9 version and no library functionality matches the dependency-confusion shape: a high-version public namesake that catches internal-name resolution and phones home from any host that resolves it. A self-labeled 'research placeholder' framing in the package description does not change the runtime behavior — installer identifiers leave the host at install time to a third-party collector the installer did not opt into. Judge assessment: This is consistent with a dependency-confusion implant that executes on install to beacon host-identifying data to an attacker-controlled collector. The package.json postinstall hook runs `node dc.js`, and `dc.js` builds a query string from `os.hostname()`, `os.userInfo().username`, `process.cwd()`, `process.platform`, `process.version`, `process.env.CI`, and `process.env.npm_config_user_agent` before sending it to a hardcoded `webhook.site` URL. The additional `dns.lookup()` path and the `abc123.oast.fun` IOC reinforce an out-of-band exfiltration workflow, not a normal library callback. The attacker model is a dependency-confusion operator harvesting install metadata from any build system that resolves `lumen-pages-community@9.9.9`, and the package’s own “research placeholder” claim does not negate the actual runtime behavior. ENTRY dc.js (install-hook: node dc.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in dc.js: ".oast.fun" - Data Encoding for Exfiltration in dc.js: "encodeURIComponent(info[k" - Network Request in dc.js: "https.get(" - System Information Collection in dc.js: "os.userInfo()" - DNS Lookup in dc.js: "dns.lookup(" - Suspicious Domain in dc.js: "oast.fun" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES dc.js