GCVE-110-OSM-2026-11547

The package's postinstall hook executes index.js, which sweeps installer-owned secrets from the home directory (.npmrc,.yarnrc,.gitconfig,.git-credentials, ~/.ssh/* private keys, ~/.aws/credentials and SSO cache, GCP application_default_credentials, Azure tokens, kubeconfig, Docker config, Terraform credentials, GitHub CLI hosts, Heroku.netrc, Vercel/Netlify/Supabase/Firebase tokens, VSCode settings, PyPI/gem/cargo credentials) and enumerates process.env for values matching TOKEN/KEY/SECRET/PASSWORD patterns, including AI provider API keys. The collected data — together with hostname, username, platform, architecture, cwd and Node version — is base64-encoded and transmitted over HTTPS to api.telegram.org/bot<redacted>/sendMessage (chat_id 8607833954) and over HTTP to 2.26.82.63:8888/collect. Execution is gated to early-return when NODE_ENV=test, CI=true, JEST_WORKER_ID or VITEST are set, or /.dockerenv exists, and is delayed by a randomized 5–15 second sleep to evade sandbox and CI observation. The package name and 999.0.1 version are consistent with a dependency-confusion lure targeting an internal package. Judge assessment: This is a credential-stealing dependency-confusion lure: the postinstall hook runs `index.js`, which explicitly reads `.npmrc`, `.gitconfig`, `.git-credentials`, `~/.ssh/*` private keys, AWS/GCP/Azure/K8s/Docker/Terraform/Vercel/Netlify/Supabase/Firebase files, and multiple AI API keys from `process.env`. The code also fingerprints the host via `os.userInfo()`, `os.hostname()`, `os.platform()`, and `process.cwd()`, then transmits the loot to the plaintext C2 `2.26.82.63` with install-time evasion guards (`NODE_ENV=test`, `CI=true`, `/.dockerenv`) and a randomized delay. The attacker model is clear: an npm dependency-confusion adversary harvesting developer and CI secrets during install, consistent with the inflated `999.0.1` version and brand-new publisher account. The OSV MAL-2026-15816 advisory is fully corroborated by the actual entrypoint and IOC classification. ENTRY index.js (install-hook: node index.js || exit 0) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Git Configuration Access in index.js: ".gitconfig" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" OBFUSCATION - String Array Obfuscation in index.js: "[ 'TOKEN', 'KEY', 'SECRET', 'PASSWORD', 'PASS', 'PWD', 'API', 'AUTH', 'CREDENTIA..." ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js