GCVE-110-OSM-2026-11672

The OpenSSF Package Analysis project identified 'oce-configurator-wireless-frontend' @ 0.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. Judge assessment: This looks like an authorized dependency-confusion beacon used for security research, not a covert credential-stealer: the package description explicitly says it is a "dependency confusion proof-of-concept" and the entrypoint comments state it only sends a single out-of-band beacon with hostname, username, cwd, platform, and npm user-agent. However, the attacker model is still indistinguishable from a real package-hijack implant from the static evidence because `preinstall.js` is an install hook that performs DNS/HTTP exfiltration to `dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online` and `5.189.159.252`, with `oast-exfiltration`, `data-exfiltration-encoding`, and `system-info-collection` all corroborating active beaconing. The package is brand-new, from a very new publisher account, and the OSV MAL advisory matches the same exfil domain, so this should be treated as a live malicious-looking artifact even if the author claims authorization. I would not submit it as confirmed malware without checking the bug-bounty context, but I would escalate it for manual review and maintain heightened suspicion. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in preinstall.js: "oast.online" - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(TOKEN" - System Information Collection in preinstall.js: "os.userInfo()" - DNS Lookup in preinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js