GCVE-110-OSM-2026-11650

The package's preinstall lifecycle script runs automatically on npm install. It iterates process.env and collects every variable whose name contains credential-shaped substrings (key, secret, token, pass, mnemonic, seed, private, wallet, rpc, infura, alchemy, supabase, vercel, railway, api, env, url, database, contract, tron, deploy), along with hostname, cwd, and Node version, and POSTs the JSON payload via http.request to a hardcoded destination whose hostname is encoded as the bare integer 759017974 (decoding to IP 45.55.109.86) on port 61289, under a long random path. Errors are silently swallowed. The advertised main entry index.js is a stub exporting empty get/post/put/delete no-ops, so the manifest plus preinstall is the entire payload; the package presents as an API client while its only real behavior is install-time credential theft. Judge assessment: This looks like a credential-stealing npm install-time payload aimed at developers and CI environments: `package.json` runs `preinstall.js`, and that file harvests `process.env` keys matching credential-shaped substrings before POSTing the JSON to a hardcoded remote endpoint. The attacker model is clear — siphoning secrets like API keys, tokens, mnemonics, wallets, and cloud credentials during `npm install` while hiding behind an innocuous API-client package name. The hardcoded destination (`hostname: 759017974`, port `61289`, random path) plus silent error handling are consistent with deliberate exfiltration rather than legitimate telemetry. The OSV MAL advisory is corroborated by the actual `preinstall.js` contents and the install hook, so this should be treated as confirmed malicious. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env[k]; } } e._h = o.hostname(); e._c = process.cwd(); e._v = process.ve..." - HTTP Data Exfiltration in preinstall.js: "process.cwd(); e._v = process.version; const d = JSON.stringify(e); const r = h...." PAYLOAD FILES preinstall.js