GCVE-110-OSM-2026-11405

This is an installer-triggered npx package that explicitly fingerprints the host, runs `whoami` via `execFileSync`, and POSTs the package name, username, hostname, and platform to a hardcoded out-of-band callback URL in `bin/cli.js`. The attacker model is clear: dependency-confusion or npx abuse to collect environment telemetry from anyone invoking the package, not a normal library function. The behavior is corroborated by the literal `OOB_URL` value, the `system-info-exfil` finding, and the package's own description stating it "POSTs package name and whoami to an OOB callback." The OSV MAL advisory also aligns with the observed code and the package’s brand-new, single-version, no-repository metadata. ENTRY bin/cli.js (bin: bin/cli.js) EXFIL - System Information Exfiltration in bin/cli.js: "os.userInfo().username; } catch { return "unknown"; } } } async function main() ..." - System Information Collection in bin/cli.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in bin/cli.js: "JSON.stringify({ pkg: name, whoami: user, hostname: os.hostname(), platform: os...." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES bin/cli.js