GCVE-110-OSM-2026-12111

The package @prime0/alanced-match is a 1-character-drop typosquat of balanced-match. Its postinstall.js runs automatically on npm install and POSTs a host fingerprint (hostname, username, platform, arch, cwd, node version, pid, non-internal IP addresses, uptime, package name) to the hardcoded bare-IP endpoint http://69.48.229.140:8080/b. Its main entry index.js opens a require-time HTTP polling channel to the same host, retrieves JSON commands from /c every 30 seconds (with 10-minute re-beacons), executes them via child_process.exec, and posts stdout/stderr back to /r — providing full remote code execution on the installer's machine. A source comment self-identifies the code as a 'Minimal stealth agent' and 'typosquat'. Judge assessment: This is a confirmed typosquat of 'balanced-match' (1-character drop). The postinstall.js fires on npm install and POSTs a full host fingerprint (hostname, username, platform, arch, IPs, cwd, node version, pid) to hardcoded C2 at 69.48.229.140:8080/b. The main index.js self-describes as a 'Minimal stealth agent for <PKGNAME> (typosquat)', establishes a persistent polling loop via setInterval every 30 seconds to /c, executes arbitrary commands received via child_process.exec, and exfiltrates stdout/stderr back to /r — full remote code execution. The publisher 'prime0' is a brand-new burner account (< 1 day old) with 50 near-identical typosquat packages, a textbook campaign pattern. The OSV advisory MAL-2026-16204 is fully corroborated by the actual source code. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Exfiltration in index.js: "os.hostname(), platform: os.platform(), arch: os.arch(), user: os.userInfo().use..." - Data Encoding for Exfiltration in index.js: "encodeURIComponent(id), function (d" - System Information Exfiltration in postinstall.js: "os.hostname() + '_' + process.pid, host: os.hostname(), platform: os.platform(),..." - Network Request in index.js: "http.request(" - System Information Collection in index.js: "os.userInfo()" - Network Request in postinstall.js: "http.request(" - System Information Collection in postinstall.js: "os.userInfo()" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js (+ postinstall.js)