GCVE-110-OSM-2026-11397

This looks like a supply-chain dropper aimed at executing a fetched payload during installation: both `preinstall` and `postinstall` run `curl -s`, and the package embeds the suspicious fetch target `da9odl2vbsgu2d3k5hbge9zpkghig83xc.cyowl.com` as a plaintext operational domain. The attacker model is a newly published npm account staging a malicious package to pull remote code or a second-stage payload at install time, which matches the very new publisher, brand-new package, and lack of repository. The OSV MAL advisory is consistent with the code-level evidence here, and the entrypoint text saying the package is a benign placeholder does not explain the install hooks or network IOC. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "curl -s \"" - Postinstall Script in package.json: ""postinstall": "curl -s \"" DESTINATION - 1 fetched-payload (domains) (values recorded in verified_iocs) EXFIL - Suspicious Domain in package.json: "http://da9odl2vbsgu2d3k5hbge9zpkghig83xc.cyowl" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account