GCVE-110-OSM-2026-11671

The OpenSSF Package Analysis project identified 'omni-channel-order-frontend' @ 0.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. Judge assessment: This is a dependency-confusion beacon package with a clear attacker model: an install-time payload that fingerprints the host and exfiltrates install metadata to an OAST/C2 endpoint. The `preinstall.js` hook runs on npm install, collects `os.hostname()`, `os.userInfo().username`, `cwd`, `__dirname`, and `npm_config_user_agent`, then sends them via DNS and HTTP to `dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online` and `5.189.159.252`. The presence of `encodeURIComponent(TOKEN)`, `dns.lookup(name, ...)`, and the `oast-exfiltration` IOC classification confirms active exfiltration rather than a benign no-op. The package metadata also fits a throwaway malicious or proof-of-concept delivery vehicle: brand-new package, very new publisher account, single version, no repository, and a preinstall hook designed to run automatically. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in preinstall.js: "oast.online" - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(TOKEN" - System Information Collection in preinstall.js: "os.userInfo()" - DNS Lookup in preinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js