GCVE-110-OSM-2026-11403

This is a dependency-confusion/credential-collection style npx package: the entrypoint in bin/cli.js runs immediately, executes `whoami` via `execFileSync`, collects `os.userInfo().username`, `os.hostname()`, and `os.platform()`, and POSTs them to the hardcoded out-of-band endpoint controlled by the attacker. The package description explicitly says it is a minimal npx package that POSTs package name and whoami to an OOB callback, which matches the code and attacker model. ENTRY bin/cli.js (bin: bin/cli.js) EXFIL - System Information Exfiltration in bin/cli.js: "os.userInfo().username; } catch { return "unknown"; } } } async function main() ..." - System Information Collection in bin/cli.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in bin/cli.js: "JSON.stringify({ pkg: name, whoami: user, hostname: os.hostname(), platform: os...." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES bin/cli.js