GCVE-110-OSM-2026-11623

package.json declares a preinstall hook that runs index.js on `npm install`. The script reads the installer's hostname and OS username, embeds them together with a timestamp into a DNS subdomain of the form `poc-<hostname>-<user>-<timestamp>.iv6mfybhp42k33ysmzi73de5w.canarytokens.com`, and issues a DNS resolution for that name, causing the installer's host and user identifiers to be transmitted to a third-party canarytokens.com collector at install time. The package name and framing indicate a dependency-confusion proof-of-concept targeting a Box-branded internal package, but the exfiltration primitive runs against any machine that installs it. Judge assessment: This is a dependency-confusion payload that executes at install time and exfiltrates host identity data to an attacker-controlled collector. The `preinstall` hook runs `index.js`, which reads `os.hostname()`, `process.env.USER`/`USERNAME`, and `process.cwd()`, then embeds the hostname and username into a DNS subdomain under `iv6mfybhp42k33ysmzi73de5w.canarytokens.com`. The attacker model is clear: any machine installing the package will leak environment-derived identifiers to the external canarytokens.com endpoint, and the code explicitly repeats the pingback after 5 seconds. The OSV advisory `MAL-2026-15921` is fully corroborated by the actual `index.js` content and the `dns.resolve(fullDomain, ...)` exfil path. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in index.js: "os.hostname()" - DNS Lookup in index.js: "dns.resolve(" PAYLOAD FILES index.js