GCVE-110-OSM-2026-10990

package.json declares both preinstall and postinstall as `node beacon.js`, so beacon.js runs automatically on every `npm install`. beacon.js reads os.hostname(), os.userInfo().username, process.cwd(), and the package name, hex-encodes the collected string, splits it into <=60-char DNS labels, and issues a DNS lookup against those labels under the author-controlled domain b0.rs. It additionally issues an HTTPS GET to https://b0.rs/?poc=...&host=...&cwd=... carrying the same fields in the query string. A source comment identifies the DNS-tunnel channel as chosen for its 'best chance of escaping egress-filtered CI', confirming the dual-channel design is intentional evasion. The version number 99.0.0 is consistent with a dependency-confusion payload targeting internal-scope name resolution. ENTRY beacon.js (install-hook: node beacon.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in beacon.js: "encodeURIComponent(pkg) + '&id=' + id" - Network Request in beacon.js: "https.get(" - System Information Collection in beacon.js: "os.userInfo()" PAYLOAD FILES beacon.js