GCVE-110-OSM-2026-12042

The OpenSSF Package Analysis project identified 'strapi-plugin-vinsoc-1109' @ 3.6.8 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. ENTRY postinstall.js (install-hook: node postinstall.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Network Request in postinstall.js: "http.get(" - System Information Collection in postinstall.js: "os.hostname()" - DNS Lookup in postinstall.js: "dns.lookup(" - Suspicious Domain in postinstall.js: "oastify.com" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES postinstall.js