GCVE-110-OSM-2026-12193

The OpenSSF Package Analysis project identified 'idx_form_script' @ 999.0.4 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. ENTRY callback.js (install-hook: node callback.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (discord-webhook) (values recorded in verified_iocs) EXFIL - Webhook Data Exfiltration in callback.js: "discord.com/api/webhooks/1549797176794943579/5GuFgIOVr6N3uWQumdUWgjxS_NpkMfW6f8l..." - Network Request in callback.js: "https.request(" - System Information Collection in callback.js: "os.userInfo()" - DNS Lookup in callback.js: "dns.resolve(" ADDITIONAL FINDINGS - Shell Command Execution in callback.js: "require('child_process')" - AWS Credential Access in callback.js: "process.env.AWS_ACCESS_KEY_ID" PAYLOAD FILES callback.js