GCVE-110-OSM-2026-12279

The OpenSSF Package Analysis project identified 'keroeltop' @ 99.99.99 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. ENTRY index.js (install-hook: node index.js --save-prod) - Install Hook Executes Local JS File in package.json - Preinstall Script in package.json - Postinstall Script in package.json DESTINATION - 2 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: "pipedream.net" - HTTP Data Exfiltration in index.js: "os.hostname() let host = "eo8f3m3ho26a0nm.m.pipedream.net" let packages = "keroe..." - Network Request in index.js: "request(`https:" - System Information Collection in index.js: "os.hostname()" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Suspicious URL Pattern in Template Literal in index.js: "https://eo8f3m3ho26a0nm.m.pipedream.net/keroeltop?h=${...}" - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js