GCVE-110-OSM-2026-12409

On npm install, both preinstall and postinstall lifecycle hooks execute callback.js, which collects installer host identity (hostname, username, platform, cwd, home directory, UID, CI/cloud indicators, npm registry) and enumerates the names of environment variables matching credential-shaped patterns (token, secret, key, password, auth, api, aws, azure, npm, git, docker, registry, artifactory, nexus, credential), then POSTs the collected data to api.telegram.org via a hardcoded bot token and chat id (1064260758) using https.request to /bot<token>/sendMessage. The lifecycle commands are wrapped in `2>/dev/null || true` to suppress errors and hide the exfil from the installer during `npm install`. A README framing this as a dependency-confusion proof of concept does not change the behavior: the package auto-executes credential-context reconnaissance and host fingerprinting against installer machines and transmits the results to an attacker-controlled Telegram channel. ENTRY callback.js (install-hook: node callback.js 2>/dev/null || true) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 2 exfil (telegram-bot, custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in callback.js: "https.request(" - System Information Collection in callback.js: "os.userInfo()" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES callback.js TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @Hsbcsirusconfusion_bot (id 8605555117)