GCVE-110-OSM-2026-11657

The package's declared preinstall script iterates process.env, filters keys against a broad credential/secret keyword list (key, secret, token, pass, private, mnemonic, seed, api, wallet, tron, rpc, infura, alchemy, database, supabase, vercel, railway, and similar), attaches hostname, cwd, and node version, and POSTs the collected JSON to a hardcoded IPv4 host encoded as the integer literal 759017974 (45.61.177.246) on port 61289 with a random-hex path. Numeric-integer encoding of the destination hides the address from string/URL scanners. The shipped index.js is a two-line no-op stub and the README does not mention any network activity, so the package's only material behavior on npm install is credential harvesting. Judge assessment: This is credential-harvesting install malware: the attacker model is a package maintainer or compromised publisher using the npm preinstall hook to steal secrets from developers' machines during install. `preinstall.js` iterates `process.env`, selectively copies keys matching high-value terms like `secret`, `token`, `mnemonic`, `seed`, `api`, `wallet`, `tron`, `rpc`, `infura`, `alchemy`, and `quicknode`, then adds hostname, cwd, and Node version before POSTing the JSON off-host. The destination is hardcoded as an integer-encoded IP (`hostname: 759017974`, i.e. 45.61.177.246) with a random-hex path on port 61289, and `package.json` executes it via `"preinstall": "node preinstall.js"`. The OSV MAL-2026-15855 advisory is corroborated by the actual file content, so this should be treated as confirmed malicious. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env[k]; } } e._h = o.hostname(); e._c = process.cwd(); e._v = process.ve..." - HTTP Data Exfiltration in preinstall.js: "process.cwd(); e._v = process.version; const d = JSON.stringify(e); const r = h...." PAYLOAD FILES preinstall.js