GCVE-110-OSM-2026-12119

The package self-identifies as a dependency confusion proof-of-concept in its description ('Simple PoC package for testing for dependency confusion vulnerabilities') and its console output ('Dependency Confusion - By: d0ug'), which places it in the bug-bounty/security-test category. The code in index.js does perform real exfiltration — collecting hostname, homedir, username, DNS servers, and package metadata, then POSTing via HTTPS to the callback domain l2ha5tswnm71286wnjgrngvb4tyejmdpe.i.dr0gas.com on preinstall — but this pattern is consistent with an OAST-style canary used by red teamers to confirm dependency confusion in target CI pipelines, not a covert attack. The dr0gas.com callback infrastructure and author email (whitehacker003@protonmail.com) are consistent with security research tooling. Despite the live exfil behavior, the explicit self-disclosure prevents a malicious verdict; however the package should not be treated as fully clean because it does collect and transmit victim environment data. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Exfiltration in index.js: "dns.getServers(), r: packageJSON ? packageJSON.___resolved : undefined, v: packa..." - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in index.js: "JSON.stringify({ p: package, c: __dirname, hd: os.homedir(), hn: os.hostname(), ..." PAYLOAD FILES index.js