GCVE-110-OSM-2026-11644

On `npm install`, the preinstall lifecycle script collects installer host identity (hostname, username, cwd) and enumerates CI-related environment variable names, base64url-encodes the collected data, chunks it into DNS labels, and transmits it via both a DNS lookup and an HTTP GET to a hardcoded subdomain of oob.lyomeri.com (e.g. easypanel-ctl.<encoded-chunk>.oob.lyomeri.com, path /npm/<encoded>). The shipped module body is a stub (`module.exports = {}`), so the package has no legitimate runtime functionality; its only effect on install is the recon beacon. The destination is an out-of-band interaction domain unrelated to the easypanel.io publisher, and the encoding plus DNS-label chunking is a covert-channel exfiltration pattern. The name `easypanel-ctl` (with an empty stub body) is consistent with a dependency-confusion lure targeting installers of an internal or unrelated `easypanel` package. Judge assessment: This package is an installer-beacon designed to exfiltrate host identity from the victim's machine on npm install, consistent with a supply-chain attacker model targeting developers and CI environments. The entrypoint `preinstall.js` collects `os.hostname()`, `os.userInfo().username`, `process.cwd()`, and CI-related env names, base64url-encodes the data, and transmits it via both `dns.lookup()` and `http.request()` to `easypanel-ctl.daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com`. The hardcoded OOB domain classified as `custom-c2`, the `data-exfiltration-encoding`, and the install hook `"preinstall":"node preinstall.js"` are direct evidence of covert exfiltration, not a benign telemetry or test harness. The OSV advisory text is corroborated by the actual file contents, and the package name plus empty runtime stub strongly suggests a dependency-confusion lure with no legitimate functionality. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(raw.slice(0,1400)),timeout:4000},res=>res.resume" - Network Request in preinstall.js: "http.request(" - System Information Collection in preinstall.js: "os.userInfo()" - DNS Lookup in preinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js