GCVE-110-OSM-2026-11409

This looks like a deliberate dependency-confusion/OOB beacon package whose attacker model is to enumerate the installing user and silently report it to the publisher. The entrypoint `bin/cli.js` hardcodes a url, gathers `whoami`, `os.hostname()`, and `os.platform()`, and POSTs them with an `npx/${name}` user agent. It also executes `whoami` via `execFileSync`, which is unnecessary for a normal package but consistent with environment fingerprinting and exfiltration. The package metadata is additionally suspicious — very new account, rapid version spam, and no repository — and OSV advisory `MAL-2026-15597` corroborates the malicious behavior. ENTRY bin/cli.js (bin: bin/cli.js) EXFIL - System Information Exfiltration in bin/cli.js: "os.userInfo().username; } catch { return "unknown"; } } } async function main() ..." - System Information Collection in bin/cli.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in bin/cli.js: "JSON.stringify({ pkg: name, whoami: user, hostname: os.hostname(), platform: os...." - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES bin/cli.js