GCVE-110-OSM-2026-11642

The package's npm preinstall hook collects the installer's hostname, OS username, current working directory, and CI-related environment variable names, base64url-encodes them, and transmits them to the hardcoded out-of-band host easypanel-client.<subdomain>.oob.lyomeri.com via both a DNS lookup and an HTTP GET request. The shipped index.js is empty (module.exports = {}), so the only effect of installing this package is the install-time beacon. The package name and structure are consistent with a dependency-confusion probe targeting internal easypanel-* names. Judge assessment: This looks like a dependency-confusion or telemetry-abuse loader whose attacker model is to beacon from the victim's install environment and siphon host/user/CWD/CI metadata during npm install. The entrypoint `preinstall.js` explicitly collects `os.hostname()`, `os.userInfo().username`, `process.cwd()`, and CI-related env names, base64url-encodes them, then sends them to the hardcoded `easypanel-client.daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com` via both `dns.lookup()` and `http.request()`. The package.json `preinstall` hook (`node preinstall.js`) ensures this runs automatically on install, and the recovered IOC is classified as `custom-c2`/`exfil` in plaintext. The README-like comment `canário benigno` is a thin disguise; the behavior is an install-time beacon consistent with malicious reconnaissance rather than a legitimate client library. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(raw.slice(0,1400)),timeout:4000},res=>res.resume" - Network Request in preinstall.js: "http.request(" - System Information Collection in preinstall.js: "os.userInfo()" - DNS Lookup in preinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js