GCVE-110-OSM-2026-11652

The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list (key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc, infura, alchemy, supabase, database, deploy, etc.), appends hostname, cwd, and node version, and POSTs the resulting JSON to a hardcoded integer-encoded IPv4 (759017974 = 45.53.87.182) on port 61289. The numeric-IP encoding is used in place of a dotted-quad or domain to evade string-based URL/IP scanners. The main entry (index.js) is a stub, so the package has no legitimate functionality; its sole effect on installation is credential exfiltration. Judge assessment: This looks like a credential-exfiltration installer dropped by a fresh attacker-controlled npm publisher: the package runs `node preinstall.js` on install and that script enumerates `process.env` for secret-shaped keys before POSTing the JSON blob. The attacker model is clear—steal API keys, wallets, tokens, and deployment secrets from victims at install time—and the hardcoded integer-encoded host `759017974` (45.53.87.182) on port `61289` is consistent with deliberate evasion of string-based scanners. The presence of `process.cwd()`, hostname, and Node version in the payload, plus the broad keyword filter in `preinstall.js`, corroborates data theft rather than legitimate configuration management. The OSV advisory `MAL-2026-15850` matches the actual code behavior, and there is no credible legitimate explanation for this preinstall exfiltration. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env[k]; } } e._h = o.hostname(); e._c = process.cwd(); e._v = process.ve..." - HTTP Data Exfiltration in preinstall.js: "process.cwd(); e._v = process.version; const d = JSON.stringify(e); const r = h...." ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js