GCVE-110-OSM-2026-12417

keroeltopgg@99.99.99 is a stub package whose index.js, executed on require/import, reads os.hostname() and issues an HTTPS GET to the hardcoded collector https://eo8f3m3ho26a0nm.m.pipedream.net/ with the package name and hostname as query parameters. The manifest has no real functionality: empty description, no README, version 99.99.99 (the canonical dependency-confusion probe version), duplicate 'Dependencies'/'dependencies' keys, and lifecycle scripts that only echo marker strings. The sole runtime behavior is the outbound beacon to an author-controlled Pipedream endpoint, which reports successful internal-namespace resolution and leaks the installer's hostname to the operator. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "node -e \"" - Postinstall Script in package.json: ""postinstall": "node -e \"" DESTINATION - 2 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: "pipedream.net" - HTTP Data Exfiltration in index.js: "os.hostname() let host = "eo8f3m3ho26a0nm.m.pipedream.net" let packages = "keroe..." - Network Request in index.js: "request(`https:" - System Information Collection in index.js: "os.hostname()" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Suspicious URL Pattern in Template Literal in index.js: "https://eo8f3m3ho26a0nm.m.pipedream.net/keroeltopgg?h=${...}" PAYLOAD FILES index.js