GCVE-110-OSM-2026-11033

Malicious package detected. Behaviors: data exfiltration, network activity, install-time execution. ENTRY beacon.js (install-hook: node beacon.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in beacon.js: "encodeURIComponent(os.hostname()) + "&p=ecobee-api", function(){}).on("error", f..." - Network Request in beacon.js: "http.get(" - System Information Collection in beacon.js: "os.hostname()" - Suspicious Domain in beacon.js: "http://169.58.96.170" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES beacon.js