GCVE-110-OSM-2026-12287

The package runs an install lifecycle script (`node index.js`) and also executes `./lib/core.js` on require. That code collects `os.userInfo().username`, `os.hostname()`, and `process.cwd()` and issues a DNS `resolve4` for a label chain of the form `<pkg>.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz`, exfiltrating installer identity and working-directory information over DNS to an attacker-controlled domain. The destination host and the `os`/`dns`/`process` module names are obfuscated in `lib/c5df9a.js` and `lib/b4ce8f.js` using char-code byte arrays (`String.fromCharCode`) and loaded via `module.constructor._load` instead of plain `require`, concealing both the APIs and the C2 destination. The obfuscation and DNS-label-encoded channel are inconsistent with the package's presentation as a shared web assets helper. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json EXFIL - Data Encoding for Exfiltration in src/resolver.js: "encodeURIComponent(version" OBFUSCATION - Obfuscation (osm-deobfuscator): unknown in lib/b4ce8f.js PAYLOAD FILES src/resolver.js