GCVE-110-OSM-2026-11902

@umschool/analytics@999.0.0 ships a postinstall.js that runs automatically on `npm install`. The script collects `os.hostname()`, `os.userInfo().username`, `os.platform()`, `process.cwd()`, and `process.version`, base64-encodes the payload, and sends it via HTTPS GET to the hardcoded third-party callback host `akko.requestcatcher.com` at path `/dep-confusion?data=<encoded>`. The implausibly high version number (999.0.0) under an organization scope is the standard dependency-confusion resolution-hijack shape: any build system configured to resolve `@umschool/*` from the public registry will fetch and execute this beacon, disclosing internal host identity and working-directory paths to an author-controlled endpoint. The package self-labels as a proof-of-concept, but the code executes the exfiltration unconditionally. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Exfiltration in postinstall.js: "os.userInfo().username; const cwd = process.cwd(); function tryRead(p) { try { r..." - Payload Download from Paste Service in postinstall.js: "requestcatcher.com" - Data Encoding for Exfiltration in postinstall.js: "encodeURIComponent(data" - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.userInfo()" - DNS Lookup in postinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Brand New Package - Rapid Version Publishing PAYLOAD FILES postinstall.js