GCVE-110-OSM-2026-11396

This package is a bug-bounty-style exfil package that exfiltrates to a custom domain owned by the attacker. The package follows standard bug bounty exfiltration practices using whoami, hostname, and time. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "curl -s \"" - Postinstall Script in package.json: ""postinstall": "curl -s \"" DESTINATION - 1 fetched-payload (domains) (values recorded in verified_iocs) EXFIL - Suspicious Domain in package.json: "http://da9ohqqvbsgu1166tuu0rrroxsztr18dt.cyowl" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account