GCVE-110-OSM-2026-1177

Exfiltrates system hostname, working directory, username, and public IP address via DNS tunneling to attacker-controlled OAST infrastructure (d73a8eir47nhci94t6i0mxbp9wjudajbk.oast.site) during npm preinstall, with output suppressed to avoid detection. preinstall runs 'node index.js > /dev/null 2>&1'. index.js calls exec() with a bash command that gathers hostname, pwd, whoami, and public IP (via curl ifconfig.me), hex-encodes the combined data with xxd, and exfiltrates each chunk via nslookup to subdomain DNS queries against d73a8eir47nhci94t6i0mxbp9wjudajbk.oast.site.