GCVE-110-OSM-2026-11945

This is a credential-stealing reverse shell implant delivered via npm install: `package.json` runs `node index.js` in postinstall, and `index.js` immediately collects `process.env` keys matching `SECRET|API|TOKEN|KEY` before sending them out over a TCP connection. The code then executes `nc -e /bin/sh ${host} ${port}`, which is a classic remote shell backdoor pattern, and the hardcoded/heuristic target includes the suspicious IP IOC. The attacker model is clear: a typosquatted package (`1nestjs`) published by a brand-new burner account is trying to harvest secrets and establish interactive remote access on victim machines. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json EXFIL - Reverse Shell in index.js: "nc -e /bin" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js