GCVE-110-OSM-2026-11673

The OpenSSF Package Analysis project identified 'vishal_312pkg' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior. Judge assessment: This is consistent with a dependency-confusion / typosquat-style test package that is nevertheless actively exfiltrating host data via an install hook. The package.json contains a preinstall command using wget and a plaintext webhook.site URL with command substitution for $(whoami), $(pwd), and $(hostname), which is a classic attacker model for collecting environment reconnaissance and leaking it off-host. The brand-new package/account metadata strengthens the abuse case, and the OSV MAL-2026-16006 advisory is corroborated by the actual exfil IOC rather than standing alone. The benign-looking index.js export does not mitigate the malicious preinstall behavior, which is sufficient to classify the package as malicious. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "wget --quiet \"" DESTINATION - 1 exfil (webhookServices) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in package.json: "webhook.site" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account