GCVE-110-OSM-2026-12121

Package declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, homedir, DNS servers, cwd, and the full package.json, and POSTs them to https://l2ha5tswnm71286wnjgrngvb4tyejmdpe.i.dr0gas.com via https.request. It additionally serializes the entire process.env with JSON.stringify(process.env) and POSTs it to the same host's /exf path via fetch. On CI and developer machines the environment routinely contains credentials (npm/AWS/GCP tokens, CI secrets), so this bulk env transmission constitutes credential harvesting. The package name and behavior are consistent with a dependency-confusion beacon. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in index.js: "JSON.stringify(process.env)" - System Information Exfiltration in index.js: "dns.getServers(), r: packageJSON ? packageJSON.___resolved : undefined, v: packa..." - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in index.js: "JSON.stringify({ p: package, c: __dirname, hd: os.homedir(), hn: os.hostname(), ..." - Very New NPM Publisher Account PAYLOAD FILES index.js