GCVE-110-OSM-2026-11651

The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings (key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc, infura, alchemy, database, supabase, vercel, railway, and others), bundles the matches with hostname, cwd, and Node version, and POSTs the JSON payload to a hardcoded destination written as the 32-bit integer 759017974 (decoding to 45.61.169.70) on port 61289. The numeric-integer form of the hostname evades trivial IP/URL string scanners. The behavior fires automatically on `npm install`, so any environment with wallet mnemonics, cloud credentials, or CI tokens in its environment will have those values shipped to the hardcoded endpoint before any package code is otherwise used. Judge assessment: This is a clear credential-stealing install-time loader: the package runs `preinstall.js` via `"preinstall": "node preinstall.js"` and the script iterates `process.env` for secret-shaped keys like `token`, `secret`, `mnemonic`, `wallet`, `rpc`, and `api`. It then bundles those values with `os.hostname()`, `process.cwd()`, and `process.version` and POSTs the JSON to a hardcoded destination (`759017974:61289`, which the advisory decodes as 45.61.169.70), matching the attacker model of stealing developer/CI credentials on install. The OSV MAL advisory is directly corroborated by the actual file contents, and the behavior is consistent with a malicious npm supply-chain implant rather than a legitimate telemetry library. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env[k]; } } e._h = o.hostname(); e._c = process.cwd(); e._v = process.ve..." - HTTP Data Exfiltration in preinstall.js: "process.cwd(); e._v = process.version; const d = JSON.stringify(e); const r = h...." PAYLOAD FILES preinstall.js