GCVE-110-OSM-2026-11136

The package declares a preinstall lifecycle script (`node index.js`) that runs automatically on `npm install`. index.js collects the installer's hostname, OS username, home directory, configured DNS servers, package metadata, and the contents of /etc/passwd and /etc/hosts, then POSTs the payload over HTTPS to dfwvktnc563cparn1p88c8051w7ovej3.oastify.com, a Burp Collaborator out-of-band host controlled by a third party. Installing the package causes installer host identifiers and system files to be exfiltrated to that endpoint. Judge assessment: This is a clear installer-side credential/data theft package: the attacker model is a supply-chain adversary abusing npm install to harvest host information from victims. The `preinstall` hook in `package.json` runs `node index.js` automatically, and `index.js` gathers `os.hostname()`, `os.userInfo().username`, `os.homedir()`, `dns.getServers()`, and even reads `/etc/passwd` and `/etc/hosts`. That data is POSTed via `https.request` to the OAST/Burp Collaborator host `dfwvktnc563cparn1p88c8051w7ovej3.oastify.com`, which matches the exfiltration IOC and confirms malicious exfiltration behavior. The minimal metadata and OSV MAL advisory further corroborate that this is not a benign telemetry package but a deliberately malicious install-time exfiltrator. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Sensitive File Access in index.js: "'/etc/passwd'" - OAST/Interactsh Exfiltration in index.js: "oastify.com" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "oastify.com" PAYLOAD FILES index.js