GCVE-110-OSM-2026-11452

Package is a dependency confusion attempt by a security researcher. The package.json manifest file calls a preinstall property that in turn calls node index.js. The index.js is a typical dependency confusion attempt and exfiltrates hostname, current directory and username to a oastify.com url controlled by the attacker