GCVE-110-OSM-2026-11941

The package's preinstall lifecycle script runs automatically on `npm install` and collects installer-side identifiers — `os.hostname()`, `os.userInfo().username`, the current working directory, and CI-related environment variable names — base64url-encodes them, and sends them to a hardcoded third-party out-of-band collector under `oob.lyomeri.com` via both a DNS lookup (`easypanel-deploy.<chunk>daco3v4q6f49egu1ds1gwjnsjb88s5kcp.oob.lyomeri.com`) and an HTTP GET request to the same host. The behavior fires without user consent on install, exfiltrates host reconnaissance data to an attacker-controlled endpoint, and is consistent with a dependency-confusion / beacon package. An in-source comment labeling this as a 'benign canary' does not change the observable behavior. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(raw.slice(0,1400)),timeout:4000},res=>res.resume" - Network Request in preinstall.js: "http.request(" - System Information Collection in preinstall.js: "os.userInfo()" - DNS Lookup in preinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account PAYLOAD FILES preinstall.js