GCVE-110-OSM-2026-12106

package.json declares preinstall and postinstall lifecycle scripts that invoke wget to POST the installer's shell-expanded working directory ($(pwd)) and machine hostname ($(hostname)) to a hardcoded Discord webhook at https://discord.com/api/webhooks/1413937656697720862/<redacted>. Both hooks fire automatically on `npm install` without user interaction. The package ships no library code or documented functionality — its sole effect is beaconing installer host identifiers to an attacker-controlled Discord endpoint. ENTRY - Preinstall Script in package.json: ""preinstall": "wget --quiet --header=\\\"" - Postinstall Script in package.json: ""postinstall": "wget --quiet --header=\\\"" DESTINATION - 1 exfil (discord-webhook) (values recorded in verified_iocs) EXFIL - Webhook Data Exfiltration in package.json: "discord.com/api/webhooks/1413937656697720862/rU1d2bB96KG-VrhF5qfz2Pes-Mz3cvvxYgp..."