GCVE-110-OSM-2026-11643

easypanel-core ships an inert `module.exports = {}` main and places all functionality in a preinstall lifecycle script. On `npm install`, preinstall.js collects os.hostname(), os.userInfo().username, process.cwd(), and the names of CI-related environment variables, base64url-encodes them, and transmits the data to `*.daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com` via both a DNS subdomain lookup and an HTTP GET to `/npm/<encoded>`. The package name mimics the easypanel project and the description advertises a 'client library', while the shipped library exports nothing and provides no functionality — the install-time beacon is the sole behavior. Judge assessment: This is a clear install-time beacon designed to exfiltrate host and CI environment data from npm installs, consistent with a package-takeover or typosquat attacker model rather than a legitimate client library. The `preinstall.js` script reads `os.hostname()`, `os.userInfo().username`, `process.cwd()`, and CI-related env var names, then sends the data to `easypanel-core.daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com` via both `dns.lookup()` and `http.request()`. The package ships as `easypanel-core` with a misleading description and no repository, while the library is effectively inert and the install hook is the sole behavior. The OSV advisory `MAL-2026-15897` is corroborated by the actual entrypoint content and recovered exfil domain, so this should be treated as malicious and submitted. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(raw.slice(0,1400)),timeout:4000},res=>res.resume" - Network Request in preinstall.js: "http.request(" - System Information Collection in preinstall.js: "os.userInfo()" - DNS Lookup in preinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js