GCVE-110-OSM-2026-12219

Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is main.js, which runs from a postinstall hook (`node main.js`) during `npm install`. main.js collects host identifiers via require('os') — os.hostname(), os.userInfo(), os.platform(), os.arch(), process.cwd(), process.version — and POSTs them as JSON over https to the hardcoded collector URL https://webhook.site/13d98b4a-1999-4ec7-92c9-0697c259ca05. The declared purpose (SQL limit enforcer) is a cover; the artifact is an install-time reconnaissance beacon.