GCVE-110-OSM-2026-11946

This is a classic install-time loader aimed at npm installers: `package.json` runs `node ./src/build.js` on postinstall, and `src/build.js` conditionally gates execution on a DNS TXT lookup to `spreadsheets-documents.com`, which is a clear attacker-controlled C2 rendezvous pattern. The OSV advisory is corroborated by the entrypoint code and the package’s anti-self-trigger check (`if (!username.includes('justin'))`), which strongly suggests the payload is meant to evade the author’s own machine while targeting other victims. The static findings also show install-hook execution, shell command capability in `src/tools.js`, and a very new publisher account, all consistent with malicious supply-chain malware rather than a normal CLI tree generator. Attacker model: a compromised or malicious npm publisher delivering a postinstall implant that fetches remote instructions and executes them on install. ENTRY src/build.js (install-hook: node ./src/build.js) - Install Hook Executes Local JS File in package.json EXFIL - System Information Collection in src/const.js: "process.platform" ADDITIONAL FINDINGS - Shell Command Execution in src/tools.js: "require("child_process")" - Very New NPM Publisher Account PAYLOAD FILES src/const.js (+ src/tools.js)