GCVE-110-OSM-2026-11415

On `npm install`, package.json's preinstall hook (`node preinstall.js || true`) auto-runs a script that (1) enumerates process.env for keys matching AWS|TOKEN|KEY|SECRET|PASS|API, concatenates them with the machine's hostname and username, base64-encodes the blob, and exfiltrates it via `curl` GET to http://216.126.236.46/r.php over plain HTTP; and (2) on non-Windows hosts invokes `bash -i` with a /dev/tcp redirection to 216.126.236.46:4444, giving the remote endpoint an interactive shell on the installer's machine. The `|| true` suffix suppresses errors so `npm install` reports success while the payload runs. The package's stated payments purpose is a cover story; the shipped preinstall behavior is credential theft plus full-host remote code execution against the installer. Judge assessment: This is a clear install-time credential theft and remote shell payload targeting the installer, not a legitimate payments SDK. The `preinstall.js` hook enumerates `process.env` for `AWS|TOKEN|KEY|SECRET|PASS|API`, base64-encodes hostname, username, and secrets, then exfiltrates to `http://216.126.236.46/r.php`; it also launches `bash -i` over `/dev/tcp/216.126.236.46/4444` for interactive RCE on non-Windows hosts. The use of `stdio: "ignore"` and `|| true` shows deliberate stealth and suppression of errors, while the brand-new publisher account and package name family (`grafeno-*`) fit a likely malicious supply-chain attacker model. The OSV MAL advisory is fully corroborated by the actual `preinstall.js` contents and the recovered IOC `216.126.236.46`. ENTRY preinstall.js (install-hook: node preinstall.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in preinstall.js: "Buffer.from(`payments|${h}|${u}|${env}`).toString("base64")" - System Information Collection in preinstall.js: "os.userInfo()" - Suspicious Domain in preinstall.js: "http://216.126.236.46" ADDITIONAL FINDINGS - Shell Command Execution in preinstall.js: "require("child_process")" - Silent Process Execution in preinstall.js: "stdio: "ignore"" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js