GCVE-110-OSM-2026-12415

commerce-materials@1.0.0 declares preinstall and postinstall lifecycle scripts that run callback.js on every npm install. callback.js collects hostname, username, platform, cwd, home directory, CI/cloud provider fingerprints, network interface addresses, and a filtered list of process.env variable names matching credential-shaped patterns (token, secret, key, password, aws, azure, gcp, npm, ssh, jwt). It also probes the current working directory for the presence of.env,.env.local,.env.production,.npmrc,.yarnrc, package-lock.json, yarn.lock,.git/config,.docker/config.json, credentials, and secrets.json. The assembled report is POSTed to api.telegram.org using a hardcoded bot token (8636277735) and chat_id (1064260758). A secondary DNS-based exfiltration channel base64-encodes host, user, and CI fields into a subdomain of dc-callback.example.com and issues dns.resolve queries, providing a fallback when HTTPS egress is filtered. The behavior fires automatically on npm install with no user interaction and no documented opt-in. ENTRY callback.js (install-hook: node callback.js 2>/dev/null || true) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 3 exfil (telegram-bot, custom-c2) - 2 c2 (telegramUsers, telegramChats) (values recorded in verified_iocs) EXFIL - Git Configuration Access in callback.js: ".git/config" - Network Request in callback.js: "https.request(" - System Information Collection in callback.js: "os.userInfo()" - DNS Lookup in callback.js: "dns.resolve(" ADDITIONAL FINDINGS - Platform Detection with Data Collection in callback.js: "JSON.stringify({ h: payload.hos" - Very New NPM Publisher Account PAYLOAD FILES callback.js TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @Nagubc_bot (id 8636277735) - 1 chat(s), 2 total member(s) observed - Threat-actor accounts: @sadfsdfgdt