GCVE-110-OSM-2026-11407

This is an intentional npx-style attacker beacon that collects the local username and host details and POSTs them to a hardcoded OOB endpoint, matching a dependency-confusion or npmtyposquat exfiltration model. The entrypoint in `bin/cli.js` calls `execFileSync("whoami")` and falls back to `os.userInfo().username`, then sends `pkg`, `whoami`, `hostname`, and `platform` to with `fetch(..., { method: "POST" })`. The package metadata also says it is a "Minimal npx package that POSTs package name and whoami to an OOB callback," which confirms malicious intent rather than a false positive. The attacker model is a publisher abusing a freshly created npm account to enumerate victims and beacon installation context to an external callback. ENTRY bin/cli.js (bin: bin/cli.js) EXFIL - System Information Exfiltration in bin/cli.js: "os.userInfo().username; } catch { return "unknown"; } } } async function main() ..." - System Information Collection in bin/cli.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in bin/cli.js: "JSON.stringify({ pkg: name, whoami: user, hostname: os.hostname(), platform: os...." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES bin/cli.js