GCVE-110-OSM-2026-12408

Package @siriusbeyond/auth@99.0.0 registers both preinstall and postinstall lifecycle scripts that execute callback.js on every `npm install`. callback.js collects installer host identifiers (hostname, username, platform, cwd, homedir, CI/cloud indicators, npm registry) together with a filtered list of environment variable names matching token/secret/key/password/aws/npm/git patterns, and POSTs a Markdown report to https://api.telegram.org/bot<token>/sendMessage using a hardcoded bot token and chat_id 1064260758 embedded in the source. The lifecycle commands are wrapped in `2>/dev/null || true` to suppress errors and hide the beacon from install output. The version number 99.0.0 and private-scope name are the standard dependency-confusion shape targeting the `@siriusbeyond` scope, causing internal builds that reference that scope to resolve to this public package and beacon out. The package's self-description as a 'Dependency Confusion PoC / security research' does not change the runtime behavior: installer-owned data leaves every machine that installs it to an author-controlled Telegram channel. ENTRY callback.js (install-hook: node callback.js 2>/dev/null || true) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 2 exfil (telegram-bot, custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in callback.js: "https.request(" - System Information Collection in callback.js: "os.userInfo()" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES callback.js TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @Hsbcsirusconfusion_bot (id 8605555117)