GCVE-110-OSM-2026-11678

The OpenSSF Package Analysis project identified 'omni-channel-oid-frontend' @ 0.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. Judge assessment: This looks like a dependency-confusion proof-of-concept / authorized security research package rather than indiscriminate malware: the header in preinstall.js explicitly says it is a "Dependency-confusion proof-of-concept beacon - BENIGN" and references a bug bounty report. However, it still executes on install via `package.json`'s `preinstall` hook and performs DNS and HTTP POST beacons to `dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online` and `5.189.159.252`, while collecting hostname, username, cwd, and npm metadata. That behavior is consistent with an attacker model of a telemetry-style beacon or dependency-confusion exfiltration, but the hardcoded research framing and limited data collected keep this from a firm malicious verdict. I would not submit this as confirmed malware; it warrants manual review because the network beacon is real even if the intent may be sanctioned testing. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in preinstall.js: "oast.online" - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(TOKEN" - System Information Collection in preinstall.js: "os.userInfo()" - DNS Lookup in preinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js