GCVE-110-OSM-2026-10869

This package is a JS wrapper that selects and executes a platform-specific native binary drawn from @postman-cse/okta-aio-darwin-arm64, @postman-cse/okta-aio-linux-arm64, or @postman-cse/okta-aio-linux-x64 — all three of which are already confirmed malicious in OSM. The attacker model is a staged supply-chain attack: the orchestrating npm package (this one) appears as a plausible Postman-branded Okta utility and delegates actual payload execution to native prebuilt binaries that evade JS-level static analysis. The src/index.js file additionally performs shell command execution via child_process, writes to .profile for persistence, and collects platform/system information — behaviors consistent with a dropper/persistence stage, not an Okta utility. The publisher account (jared.boynton) is 37 days old, has 68 packages, and a 10% malicious ratio across checked packages, all pointing to a fabricated identity. The absence of any repository, description, or verifiable Postman organizational link confirms this is not a legitimate internal tool accidentally published. ENTRY bin/okta-aio-js.js (bin: bin/okta-aio-js.js) PERSISTENCE - Startup Persistence in src/index.js: ".profile" EXFIL - System Information Collection in src/index.js: "process.platform" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Shell Command Execution in src/index.js: "require('child_process')" - Publisher Shows Burner-Account Pattern - Malicious Dependency Detected (OSM) in package.json PAYLOAD FILES src/index.js