GCVE-110-OSM-2026-1139

Suspected dependency confusion attack. Behaviors: data exfiltration, code execution, network activity, install-time execution. Payload: index.js Key findings: - Environment Variable Exfiltration in index.js: "process.env.CI ? 'ci' : process.env.NODE_ENV || 'unknown', whoami: safeExec('w..." - System Information Exfiltration in index.js: "os.userInfo().username, platform: os.platform(), arch: os.arch(), cwd: pro..." - OAST/Interactsh Exfiltration in index.js: ".oast.fun" - Shell Command Execution in index.js: "require('child_process')" - Suspicious Domain in index.js: "oast.fun" IOCs: - domains: wearehackerone.com, favucjwarmsamdhabjlqt1eabxtbj4vjd.oast.fun, process.env.CI - emails: absshax@wearehackerone.com - payloadFileHash: 9d0414e24e41600c5173094a76f61bed8e7883062bbb9c19e63d6389443a55e5