GCVE-110-OSM-2026-12151

The package declares a postinstall script (postinstall.js) that runs automatically on `npm install`. The script collects host reconnaissance data — os.hostname(), os.platform(), kernel release, uid/gid, all network interface addresses, memory and CPU info — base64-encodes the JSON payload, and POSTs it over plain HTTP to the hardcoded out-of-band host vml73pdk3ft3t434ssjycv4khbn2btzi.oastify.com (a Burp Collaborator subdomain). The package name mimics strapi-plugin-os-info but has no legitimate plugin functionality; the only shipped behavior is the install-time beacon to an attacker-controlled OOB interaction endpoint. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Data Encoding for Exfiltration in postinstall.js: "Buffer.from(json).toString('base64')" - Network Request in postinstall.js: "http.request(" - System Information Collection in postinstall.js: "os.hostname()" - Suspicious Domain in postinstall.js: "oastify.com" ADDITIONAL FINDINGS - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({ data: b64, size: json.length, }); const req = http.request({ ho..." PAYLOAD FILES postinstall.js