GCVE-110-OSM-2026-12411

package.json declares both preinstall and postinstall running `node callback.js`, so the payload fires automatically on `npm install`. callback.js collects hostname, username, platform, cwd, home directory, network interfaces, uid/gid, CI/cloud provider fingerprints, and probes the working directory for credential files (.env,.npmrc,.yarnrc,.git/config,.docker/config.json, credentials, secrets.json). It also enumerates process.env keys and filters them against a broad credential-name regex set (token, secret, key, password, aws, azure, gcp, npm, ssh, private, credential, jwt, bearer, stripe, db, mysql, postgres, mongo, redis). The collected payload is POSTed to api.telegram.org via a hardcoded Telegram Bot API token and chat_id (1064260758). A secondary DNS-based side channel base64-encodes host/user/CI fields and issues a `dns.resolve` against a `<encoded>.dc-callback.example.com` subdomain as a fallback for environments that block HTTPS to Telegram. The package presents itself as a byted/commerce materials module and a `security research / dependency confusion PoC`; the self-label does not change that the traced behavior harvests installer host and credential reconnaissance and ships it off-host to attacker-controlled channels without consent. ENTRY callback.js (install-hook: node callback.js 2>/dev/null || true) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 3 exfil (telegram-bot, custom-c2) - 2 c2 (telegramUsers, telegramChats) (values recorded in verified_iocs) EXFIL - Git Configuration Access in callback.js: ".git/config" - Network Request in callback.js: "https.request(" - System Information Collection in callback.js: "os.userInfo()" - DNS Lookup in callback.js: "dns.resolve(" ADDITIONAL FINDINGS - Platform Detection with Data Collection in callback.js: "JSON.stringify({ h: payload.hos" - Very New NPM Publisher Account PAYLOAD FILES callback.js TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @Nagubc_bot (id 8636277735) - 1 chat(s), 2 total member(s) observed - Threat-actor accounts: @sadfsdfgdt