GCVE-110-OSM-2026-11641

The package's preinstall lifecycle script runs automatically on npm install and collects installer identity (os.hostname(), os.userInfo().username, process.cwd()) along with the names of CI-related environment variables. The collected data is JSON-serialized, base64url-encoded, chunked into DNS label form, and exfiltrated to a hardcoded third-party out-of-band collector at *.oob.lyomeri.com via both a dns.lookup() call and an HTTP GET to easypanel-app.daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com. The name mimics the legitimate Easypanel project and the shape (preinstall + host/username/cwd + OOB DNS+HTTP beacon to a per-package subdomain) is a dependency-confusion reconnaissance beacon, disclosing installer identity and internal-package-name existence to a third party regardless of any 'benign canary' self-label. Judge assessment: This is a dependency-confusion reconnaissance beacon: the attacker model is a package author mimicking Easypanel to collect installer identity and signal package presence to an out-of-band collector on install. The preinstall hook in `preinstall.js` gathers `os.hostname()`, `os.userInfo().username`, `process.cwd()`, and CI-related env names, then base64url-encodes and transmits them via both `dns.lookup()` and `http.request()` to `*.oob.lyomeri.com`. The self-described "canário benigno" comment does not match the behavior, because the code still exfiltrates data to a hardcoded third-party domain and runs automatically through `"preinstall":"node preinstall.js"`. The OSV advisory is corroborated by the actual entrypoint and IOCs, so this should be treated as malicious. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(raw.slice(0,1400)),timeout:4000},res=>res.resume" - Network Request in preinstall.js: "http.request(" - System Information Collection in preinstall.js: "os.userInfo()" - DNS Lookup in preinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js