GCVE-110-OSM-2026-11625

The package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP (via api.ipify.org), OS hostname, and GitHub Actions / CI environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, and related identifiers), then sends them as query parameters in an HTTPS GET to a hardcoded collector at https://webhook.site/66059630-2030-4b44-b2df-d37e02be0a7d. It also performs a DNS lookup encoding the hostname as a subdomain of an out-of-band collaborator domain (left as the placeholder your-collab-domain.oastify.com). Behavior fires automatically on npm install with no user interaction. Judge assessment: This package is an install-time data exfiltrator: the `preinstall` hook runs `vishu.js`, which automatically executes during `npm install` and collects the installer’s public IP, `os.hostname()`, and CI/GitHub Actions environment variables before sending them to a hardcoded collector. The code then performs a DNS lookup against `your-collab-domain.oastify.com`, which is classic OAST/callback infrastructure, and the plaintext `https://webhook.site/66059630-2030-4b44-b2df-d37e02be0a7d` IOC is classified as exfil. The attacker model is a supply-chain package implanted to fingerprint and beacon from developer or CI machines; the `vishu.js` entrypoint and the `package.json` preinstall hook make the behavior unavoidable on install. The new publisher account and lack of repository further reinforce that this is not a legitimate telemetry library but a malicious install payload. ENTRY vishu.js (install-hook: node vishu.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in vishu.js: "oastify.com" - Network Request in vishu.js: "https.request(" - System Information Collection in vishu.js: "os.hostname()" - DNS Lookup in vishu.js: "dns.lookup(" - Suspicious Domain in vishu.js: "oastify.com" ADDITIONAL FINDINGS - Very New NPM Publisher Account PAYLOAD FILES vishu.js