GCVE-110-OSM-2026-11645

The preinstall lifecycle script collects host fingerprint data (os.hostname(), os.userInfo().username, process.cwd(), and CI-related environment variable names), base64url-encodes the JSON payload, sanitizes it into DNS-safe characters, and chunks it into ≤50-character DNS labels. The encoded payload is exfiltrated to a hardcoded out-of-band host at easypanel-docker.daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com via both dns.lookup() (DNS tunneling) and an http.request() GET to /npm/<payload>. This fires automatically on `npm install`. The package name mimics the popular easypanel Docker deployment tooling, and the DNS+HTTP dual-channel OOB shape matches dependency-confusion / typosquat beacon activity; an in-source comment labelling this a benign canary does not change the behavior. Judge assessment: This is an install-time credential and host-fingerprinting beacon that runs automatically via the `preinstall` hook in `package.json`, so the attacker model is a typosquatted npm package harvesting environment and machine metadata on install. The entrypoint shows `os.hostname()`, `os.userInfo().username`, `process.cwd()`, and CI-related env names being serialized, base64url-encoded, and sent to a hardcoded out-of-band host using both `dns.lookup()` and `http.request()` to `/npm/<payload>`. The comment claiming "canário benigno" does not change the behavior; the dual DNS/HTTP exfil path to `easypanel-docker.daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com` is consistent with dependency-confusion / typosquat telemetry collection. The OSV advisory is corroborated by the actual `preinstall.js` contents and the package's brand-new publisher/account metadata, so this should be treated as confirmed malicious. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(raw.slice(0,1400)),timeout:4000},res=>res.resume" - Network Request in preinstall.js: "http.request(" - System Information Collection in preinstall.js: "os.userInfo()" - DNS Lookup in preinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js