GCVE-110-OSM-2026-11255

This is an install-time beacon intended to fingerprint the victim host and exfiltrate it to attacker-controlled infrastructure, matching a classic supply-chain attacker model rather than a benign telemetry use. The package.json preinstall hook runs `node beacon.js || true`, and that file sends `os.hostname()`, `os.userInfo().username`, `process.platform`, and `process.arch` via `http.get`/`https.get` to an IP address and secondarily to an attacker controlled URL on `/npm-install?`. ENTRY beacon.js (install-hook: node beacon.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - 4 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in beacon.js: "encodeURIComponent(os.hostname" - Network Request in beacon.js: "http.get(" - System Information Collection in beacon.js: "os.userInfo()" - Suspicious Domain in beacon.js: "http://104.236.2.79" PAYLOAD FILES beacon.js