GCVE-110-OSM-2026-11927

The package's preinstall lifecycle script runs automatically on `npm install` and sends the installer's hostname, OS username, and current working directory to a hardcoded remote host at http://209.126.81.147 over plain HTTP, embedding the values as URL path segments under `/etoro-depconf-poce346552f776f/npm/`. The destination is a bare IP address, not configurable, and unrelated to any legitimate publisher infrastructure. The `999.0.0` version and eToro-themed name are consistent with a dependency-confusion lure targeting an internal package name. ENTRY preinstall.js (install-hook: node preinstall.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(os.hostname())}/${encodeURIComponent(os.userInfo().username)}..." - Network Request in preinstall.js: "https.get(" - System Information Collection in preinstall.js: "os.userInfo()" - Suspicious Domain in preinstall.js: "http://209.126.81.147" PAYLOAD FILES preinstall.js