GCVE-110-OSM-2026-10870

This looks like a canary-style package published by a security researcher. An install-time data collector that targets npm installers by running `postinstall.js` automatically and sending host identity off-box. The attacker model is a dependency-confusion or typosquatting install trap under the `fuel-react` name: it runs as a postinstall hook, fingerprints the environment, and exfiltrates data that can reveal CI context and potentially secrets present in environment variables. The minimal metadata and OSV MAL advisory corroborate that the package is behaving as a public-package lure rather than a normal React library. The entrypoint clearly builds a payload with `os.hostname()`, `process.platform`, `process.arch`, `process.version`, and `process.env.CI`, then transmits it via `https.request()` to `ALERT_ENDPOINT`, which defaults to `https://alerts.example.com/npm-install` and can be overridden by `NPM_CANARY_ALERT_ENDPOINT`. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.hostname()" PAYLOAD FILES postinstall.js