GCVE-110-OSM-2026-11133

On npm install, the package's preinstall hook executes index.js which harvests host and user identity data (os.hostname(), os.platform(), os.arch(), os.userInfo() including username/uid/gid/shell, homedir, cwd) and captures the output of the shell commands `whoami` and `id` via child_process. The collected data is serialized as JSON and POSTed to the hardcoded endpoint https://839wbtybgrvpgbqzd0l8po2ozf56tyhn.oastify.com/system-info, a Burp Collaborator (oastify.com) out-of-band interaction subdomain unrelated to any legitimate analytics functionality. The behavior fires automatically as part of the npm install lifecycle with no user interaction. Judge assessment: This package is a classic install-time credential and environment exfiltration implant: `package.json` runs `preinstall: node index.js`, so the code executes automatically on npm install. The entrypoint collects host and user identity data via `os.hostname()`, `os.platform()`, `os.arch()`, `os.userInfo()`, plus `whoami` and `id` through `child_process.exec`, then serializes the result and POSTs it to the hardcoded Burp Collaborator/OAST URL `https://839wbtybgrvpgbqzd0l8po2ozf56tyhn.oastify.com/system-info`. The attacker model is a supply-chain loader harvesting machine and user fingerprints for an operator-controlled exfil endpoint, and the code matches that goal exactly with no plausible legitimate analytics purpose. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: "oastify.com" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "oastify.com" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" PAYLOAD FILES index.js