GCVE-110-OSM-2026-10862

This looks like an authorized dependency-confusion proof-of-concept rather than covert malware: the package metadata explicitly says "AUTHORISED SECURITY RESEARCH" and the code is labeled `__securityResearch: true`. That said, the package still runs as a `preinstall` hook and clearly collects host/user data (`os.userInfo()`, `os.hostname()`, `INIT_CWD`) before sending it to `da4v7l8hb2uc72ugqfmgk64edkj89qcok.oast.fun`, including DNS-based exfiltration and base64 encoding. The attacker model is a burner-account dependency-confusion test package used to beacon installs from a victim project, but the presence of a real OAST C2 and exfil logic means it is not benign even if the intent is research. OSV's claim that the domain is associated with malicious activity is corroborated by the code path, but the self-identifying security-research context keeps this just short of a definitive malicious verdict. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: ".oast.fun" - Data Encoding for Exfiltration in index.js: "Buffer.from(body).toString("base64")" - System Information Collection in index.js: "os.userInfo()" - DNS Lookup in index.js: "dns.resolve(" - Suspicious Domain in index.js: "oast.fun" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js