GCVE-110-OSM-2026-11944

This is a credential-stealing reverse-shell dropper aimed at anyone installing the typosquatted npm package '0nestjs' instead of 'nestjs'. The install hook in package.json runs 'node index.js' on postinstall, and index.js explicitly collects environment variables matching SECRET/API/TOKEN/KEY before writing them over a network connection and invoking 'nc -e /bin/sh' via child_process.exec. The hardcoded/derived host and port logic, the plaintext exfiltration of env data, and the reverse-shell command match a clear attacker model for initial access and remote command execution. The new burner-style publisher metadata and OSV MAL advisory further corroborate malicious intent. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json EXFIL - Reverse Shell in index.js: "nc -e /bin" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js