GCVE-110-OSM-2026-10861

This package is a classic bug-bounty-style dependency confusion PoC. It's a dependency-confusion install hook that explicitly beacons install-time host data to a custom C2, matching an attacker model of credentialless reconnaissance and environment fingerprinting from a burner publisher. The entrypoint in `index.js` runs on `preinstall`, collects `os.userInfo()`, `os.hostname()`, `INIT_CWD`, local IP, parent project metadata, then exfiltrates it to `da4v7l8hb2uc72ugqfmgk64edkj89qcok.oast.fun` over DNS plus HTTPS/HTTP. The payload is base64-encoded before transmission and the code preferentially uses DNS to evade egress filtering, which is consistent with malicious exfiltration rather than a legitimate security proof-of-concept. The OSV advisory, brand-new account, inflated version `999.9.10`, and burner-account pattern corroborate the malicious intent. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: ".oast.fun" - Data Encoding for Exfiltration in index.js: "Buffer.from(body).toString("base64")" - Network Request in index.js: "https.get(" - System Information Collection in index.js: "os.userInfo()" - DNS Lookup in index.js: "dns.resolve(" - Suspicious Domain in index.js: "oast.fun" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js