GCVE-110-OSM-2026-11677

The OpenSSF Package Analysis project identified 'ocfe-tv-subscription-center-web' @ 0.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. Judge assessment: This looks like a dependency-confusion proof-of-concept beacon rather than an ordinary library: the install hook in `package.json` runs `preinstall.js`, and that script performs DNS and HTTP POSTs to an OAST endpoint plus a hardcoded IP. The code collects `os.userInfo().username`, `os.hostname()`, `cwd`, `installPath`, platform, Node version, and npm user-agent, which is consistent with a beaconing test but also matches attacker reconnaissance and exfiltration patterns. The attacker model here is a malicious publisher or compromised test package using install-time telemetry to phone home, but the embedded comments and `HackerOne`/bug-bounty context indicate an authorized security research placeholder. Because the behavior is real and networked yet plausibly legitimate for a triage PoC, I would not call it clean, but I also would not escalate it to confirmed malicious without the surrounding authorization context. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in preinstall.js: "oast.online" - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(TOKEN" - System Information Collection in preinstall.js: "os.userInfo()" - DNS Lookup in preinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js