GCVE-110-OSM-2026-11410

This looks like an OOB beacon package built to fingerprint the host and exfiltrate identity data when the npm bin entrypoint runs, which fits a dependency-confusion or reconnaissance attacker model. The entrypoint `bin/cli.js` sends `pkg`, `whoami`, `hostname`, and `platform` to the hardcoded url via `fetch(..., { method: "POST" })`, and it also invokes `execFileSync("whoami")` to collect a username. The package metadata is also highly suspicious: a brand-new single-version package from a very new account, with a description that explicitly says it POSTs package name and whoami to an OOB callback. The OSV advisory and the static findings both corroborate the same behavior, so this is not a false positive. ENTRY bin/cli.js (bin: bin/cli.js) EXFIL - System Information Exfiltration in bin/cli.js: "os.userInfo().username; } catch { return "unknown"; } } } async function main() ..." - System Information Collection in bin/cli.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in bin/cli.js: "JSON.stringify({ pkg: name, whoami: user, hostname: os.hostname(), platform: os...." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES bin/cli.js