GCVE-110-OSM-2026-11406

This looks like a deliberate npx-style OOB beacon meant to identify victims and phone home: the entrypoint in `bin/cli.js` runs on package execution and sends `pkg`, `whoami`, `hostname`, and `platform` to the hardcoded url. The attacker model is a dependency-confusion or test-package operator collecting environment fingerprints from anyone who executes the package, and the code explicitly uses `execFileSync("whoami")` plus a POST body to exfiltrate the data. The brand-new package, very new publisher account, single-version release, and no repository all reinforce that this is intentionally disposable malware rather than a legitimate library. The OSV MAL advisory is also corroborated by the actual code and not contradicted by the file contents. ENTRY bin/cli.js (bin: bin/cli.js) EXFIL - System Information Exfiltration in bin/cli.js: "os.userInfo().username; } catch { return "unknown"; } } } async function main() ..." - System Information Collection in bin/cli.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in bin/cli.js: "JSON.stringify({ pkg: name, whoami: user, hostname: os.hostname(), platform: os...." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES bin/cli.js