GCVE-110-OSM-2026-10866

The postinstall.js code implements a recognizable dependency-confusion canary pattern — collecting hostname, platform, arch, and CI flag and POSTing to a configurable endpoint — and the default endpoint is a non-functional placeholder (alerts.example.com), making the code itself relatively transparent. However, the publisher 'questions553' has a 100% malicious-package ratio (fuel-react already flagged), a sub-day-old account, no repository, and an anomalously high version number (91.0.0) typical of dependency confusion squatting. The 'canary' self-description is a plausible cover story: if the real deployment configures NPM_CANARY_ALERT_ENDPOINT, the same code silently exfiltrates install telemetry to an attacker-controlled server. The combination of a publisher with confirmed malicious history, a dependency-confusion-aligned package name, and a postinstall network beacon warrants escalated review even though the code in isolation would pass scrutiny. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.hostname()" ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Has Other Malicious Packages PAYLOAD FILES postinstall.js