GCVE-110-OSM-2026-11895

The package's postinstall script (beacon.js), also re-executed on require via index.js, sends the installer's hostname, run identifiers, and the output of the `id` shell command to a hardcoded third-party collector at https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b over HTTPS. The same script probes the GCP instance metadata service at 169.254.169.254 and metadata.google.internal with the `Metadata-Flavor: Google` header and reports the status and body back to the webhook, disclosing whether the install environment is a cloud VM and what IMDS returns. Data leaves the installer's host to an attacker-controlled collector automatically on `npm install` and on `require()`, without consent. ENTRY beacon.js (install-hook: node beacon.js postinstall) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in beacon.js: "webhook.site" - Network Request in beacon.js: "https.get(" - System Information Collection in beacon.js: "os.hostname()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in beacon.js: "JSON.stringify({ runId: myRunId, host: os.hos" - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES beacon.js