GCVE-110-OSM-2026-12109

index.js and the postinstall lifecycle script contact a hardcoded bare-IP endpoint at http://69.48.229.140:8080 over plain HTTP. On `npm install`, the postinstall hook collects host identifiers (hostname, username, platform, arch, cwd, node version, pid, all non-internal IP addresses, uptime, package name) and POSTs them as JSON to /b. On `require()` of the package main, the module beacons the same host, then polls /c every 30 seconds for JSON commands and executes the `c` field via child_process.exec, POSTing stdout/stderr back to /r. A source comment self-identifies the module as a stealth typosquat agent, while package.json advertises only a generic "small utility" description. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Exfiltration in index.js: "os.hostname(), platform: os.platform(), arch: os.arch(), user: os.userInfo().use..." - Data Encoding for Exfiltration in index.js: "encodeURIComponent(id), function (d" - System Information Exfiltration in postinstall.js: "os.hostname() + '_' + process.pid, host: os.hostname(), platform: os.platform(),..." - Network Request in index.js: "http.request(" - System Information Collection in index.js: "os.userInfo()" - Network Request in postinstall.js: "http.request(" - System Information Collection in postinstall.js: "os.userInfo()" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Very New NPM Publisher Account - Publisher Has Other Malicious Packages - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js (+ postinstall.js)