GCVE-110-OSM-2026-11414

grafeno-billing@1.0.0 is a stub package whose only substantive code is a preinstall lifecycle hook. On npm install, preinstall.js enumerates process.env, filters keys matching AWS|TOKEN|KEY|SECRET|PASS|API, concatenates them with hostname and username, base64-encodes the result, and sends it via curl GET to http://216.126.236.46/r.php. On non-Windows hosts the same script also launches an interactive bash reverse shell to 216.126.236.46:4444 via /dev/tcp, giving the operator of that endpoint command execution on the installer's machine. The shipped index.js is a one-line stub returning a fake createInvoice result, with no real billing functionality, confirming the package exists solely to deliver the install-time attack. Judge assessment: This package is a classic install-time credential theft and remote shell dropper delivered through a preinstall hook, consistent with a supply-chain attacker targeting npm consumers. The entrypoint `preinstall.js` reads `process.env`, filters for `AWS|TOKEN|KEY|SECRET|PASS|API`, base64-encodes hostname/username/env data, and sends it to `http://216.126.236.46/r.php`, then launches a `/dev/tcp/216.126.236.46/4444` bash reverse shell on non-Windows hosts. The `package.json` preinstall script ensures this runs automatically on install, and the static IOC classification marks `216.126.236.46` as exfil/custom-C2 in plaintext. The OSV advisory is corroborated directly by the file contents, so this should be treated as confirmed malicious package behavior. ENTRY preinstall.js (install-hook: node preinstall.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in preinstall.js: "Buffer.from(`billing|${h}|${u}|${env}`).toString("base64")" - System Information Collection in preinstall.js: "os.userInfo()" - Suspicious Domain in preinstall.js: "http://216.126.236.46" ADDITIONAL FINDINGS - Shell Command Execution in preinstall.js: "require("child_process")" - Silent Process Execution in preinstall.js: "stdio: "ignore"" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js