GCVE-110-OSM-2026-11622

box-sign-client@1.0.0 is a dependency-confusion vehicle positioned against the internal Box namespace (@box/sign-client). Its package.json declares a preinstall script (`node index.js`) that reads `os.hostname()` and `process.env.USER`/`USERNAME`, embeds those values into a subdomain of the hardcoded host `iv6mfybhp42k33ysmzi73de5w.canarytokens.com`, and calls `dns.resolve()` to trigger a DNS lookup against that subdomain. On any `npm install` that resolves this public package instead of the intended internal one, the installing host's hostname and login user are transmitted via DNS to a third-party Canarytokens collector at install time, before any application code is run. The package advertises itself as a proof-of-concept for Box dependency confusion, but the beacon fires against any installer regardless of intent. Judge assessment: This is a dependency-confusion payload targeting the internal Box namespace (`@box/sign-client`) and is designed to beacon from any victim running `npm install`. The attacker's goal is explicit in `package.json` (`preinstall: node index.js`) and the code in `index.js` collects `os.hostname()`, `process.env.USER`/`USERNAME`, and `process.cwd()` before embedding identifiers into a DNS query to the hardcoded Canarytokens C2 domain `iv6mfybhp42k33ysmzi73de5w.canarytokens.com`. The preinstall hook ensures execution before application code, and the OSV advisory matches the observed behavior exactly, confirming install-time exfiltration via DNS. This is malicious against any installer resolving the public package instead of the private Box package, so the appropriate action is to submit and alert maintainers. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in index.js: "os.hostname()" - DNS Lookup in index.js: "dns.resolve(" PAYLOAD FILES index.js