GCVE-110-OSM-2026-11411

This is an explicit OOB callback package that collects the current user via `whoami`, falls back to `os.userInfo().username`, and then sends `pkg`, `whoami`, `hostname`, and `platform` to a url, from the `bin/cli.js` entrypoint. The attacker model is dependency-confusion or npx-driven reconnaissance: a newly published package by a very new publisher account (`6ughunt3r9`) that phones home on execution and brands itself as a minimal callback package. The use of `execFileSync("whoami")` plus `fetch(..., { method: "POST" })` and the hardcoded external OOB domain is direct exfiltration, not a benign telemetry pattern. OSV advisory `MAL-2026-15599` also aligns with the observed behavior, but the code itself is sufficient to confirm malicious intent. ENTRY bin/cli.js (bin: bin/cli.js) EXFIL - System Information Exfiltration in bin/cli.js: "os.userInfo().username; } catch { return "unknown"; } } } async function main() ..." - System Information Collection in bin/cli.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in bin/cli.js: "JSON.stringify({ pkg: name, whoami: user, hostname: os.hostname(), platform: os...." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES bin/cli.js