GCVE-110-OSM-2026-11655

The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped substrings (key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc, infura, alchemy, supabase, database), attaches hostname, cwd, and node version, and POSTs the JSON payload to a hardcoded remote host written as the decimal integer 759017974 (which resolves to 45.63.10.182) on port 61289. The integer form of the destination host defeats plain-text IOC scanning. The package's index.js is a non-functional stub that exports a no-op createClient returning empty results, confirming the library body is cover and the package exists solely to run the install-time credential stealer. The scoped name resembles a private/internal organization scope, consistent with a dependency-confusion delivery shape. Judge assessment: This is an install-time credential stealer that matches a classic dependency-confusion attacker model: a scoped npm package with minimal metadata whose only meaningful behavior is a preinstall hook that harvests credential-shaped environment variables and POSTs them off-host. The `preinstall.js` logic explicitly collects keys containing `key`, `secret`, `token`, `pass`, `mnemonic`, `seed`, `private`, `wallet`, `api`, `rpc`, `infura`, `alchemy`, `supabase`, and similar substrings, then sends the JSON payload to a hardcoded remote destination (`759017974:61289`, resolved in the advisory to `45.63.10.182`). The package.json `"preinstall": "node preinstall.js"` ensures the code runs automatically on install, and the stubbed behavior described in the OSV advisory is consistent with the file content showing the package body is cover. This is high-confidence malicious behavior consistent with theft of developer or CI secrets for later account compromise or infrastructure abuse. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env[k]; } } e._h = o.hostname(); e._c = process.cwd(); e._v = process.ve..." - HTTP Data Exfiltration in preinstall.js: "process.cwd(); e._v = process.version; const d = JSON.stringify(e); const r = h...." PAYLOAD FILES preinstall.js