GCVE-110-OSM-2026-12412

catwrestlingbird@1.0.0 declares a `postinstall` script (`node install.js`) that automatically runs on `npm install`. install.js collects installer host reconnaissance — hostname, username, platform/arch/OS release, network interfaces, a depth-3 listing of the current working directory, selected environment variables, and the output of `ss`/`netstat`, `arp`/`ip neigh`, and `ip route`/`route` — and POSTs the JSON payload to a hardcoded plain-HTTP endpoint at `http://192.168.4.216:3000/api/beacon`. install.js then spawns heartbeat.js as a detached, unref'd child process so it survives beyond install. heartbeat.js long-polls the same C2 every 60 seconds; on a `shell` task it upgrades to a WebSocket at `/ws/shell/<beacon_id>/open`, spawns `/bin/sh`, pipes the shell's stdout/stderr back to the server as WebSocket frames, and writes inbound WebSocket frames into the shell's stdin — a fully remote-controlled interactive shell on the installer's host, gated only by a hardcoded `x-beacon-secret`. A `kill` response from the C2 rewrites the installer's package.json and package-lock.json to remove the package and recursively deletes the package directory, providing a remote self-destruct/anti-forensics path. A SHA-256 hashcash proof-of-work handshake against `/api/pow` gates the beacon. The package description is empty and no functionality is advertised to the installer. ENTRY install.js (install-hook: node install.js) - Install Hook Executes Local JS File in package.json DESTINATION - 3 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in install.js: "process.env, DOLUS_C2: C2_URL, DOLUS_PKG: PKG_NAME, DOLUS_BEACON_ID: BEACON_ID, ..." - System Information Exfiltration in install.js: "__dirname, 'heartbeat.js')], { detached: true, stdio: 'ignore', env: { ...proces..." - Network Request in heartbeat.js: "request({ hostname: u.hostname, port: u.port || (u.protocol === 'https:" - Network Request in install.js: "request({ hostname: url.hostname, port: url.port || (url.protocol === 'https:" - System Information Collection in install.js: "os.userInfo()" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in install.js: "spawn(process.execPath, [path.join(__dirname, 'heartbeat.js')], { detached: true..." - Reconstructed Obfuscated URL in install.js: "http://192.168.4.216:3000/api/pow" - Shell Command Execution in heartbeat.js: "require('child_process')" - Silent Process Execution in install.js: "stdio: 'ignore'" - Detached Child Process Payload in install.js: "spawn(process.execPath, [path.join(__dirname, 'heartbeat.js')], { detached: true" - Very New NPM Publisher Account PAYLOAD FILES install.js