GCVE-110-OSM-2026-11785

Package cat-sis2go-utils@99.0.0 declares both preinstall and postinstall lifecycle hooks in package.json that execute scripts/run.js on every npm install. The script unconditionally issues a DNS lookup against d22d92dc-84e5-4b58-8cd6-75bf1ac452c7.dnshook.site and POSTs a JSON beacon containing the installer's hostname and process context to https://webhook.site/d22d92dc-84e5-4b58-8cd6-75bf1ac452c7. The package description self-identifies as a dependency-confusion PoC, and the 99.0.0 version is consistent with a resolution-winning squat targeting an internal package name. Installing the package results in arbitrary code execution on the installer host and fingerprints the machine to third-party out-of-band collectors under the operator's control. ENTRY scripts/run.js (install-hook: node scripts/run.js preinstall) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in scripts/run.js: "process.env.USER || process.env.USERNAME || 'unknown', hostname: os.hostname() }..." - OAST/Interactsh Exfiltration in scripts/run.js: "webhook.site" - HTTP Data Exfiltration in scripts/run.js: "os.userInfo().username) || process.env.USER || process.env.USERNAME || 'unknown'..." - Network Request in scripts/run.js: "request({ hostname: u.hostname, port: u.port || (u.protocol === 'https:" - System Information Collection in scripts/run.js: "os.userInfo()" - DNS Lookup in scripts/run.js: "dns.lookup(" ADDITIONAL FINDINGS - Platform Detection with Data Collection in scripts/run.js: "JSON.stringify({ username: (os.userInfo && os" - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES scripts/run.js