GCVE-110-OSM-2026-12418

Package keroeltopkk@99.99.99 ships only a manifest and a beacon script (server.js) and wires it into every npm lifecycle hook (preinstall/install/postinstall/prepare), so `npm install` auto-executes it. server.js reads os.hostname() and issues an HTTPS GET to https://eo8f3m3ho26a0nm.m.pipedream.net/${packageName}?h=${hostname}, a Pipedream request-bin acting as an attacker-controlled collector. The package version 99.99.99, empty description, absence of any real functionality, and duplicated Dependencies/dependencies keys are consistent with a dependency-confusion reconnaissance squat: the attacker publishes a high-version stub under a name that may match an internal/private package so that misconfigured resolvers pull the public stub and beacon the victim's hostname back on install. ENTRY server.js (install-hook: node server.js --save-prod) - Install Hook Executes Local JS File in package.json - Preinstall Script in package.json - Postinstall Script in package.json DESTINATION - 2 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in server.js: "pipedream.net" - HTTP Data Exfiltration in server.js: "os.hostname() let host = "eo8f3m3ho26a0nm.m.pipedream.net" let packages = "keroe..." - Network Request in server.js: "request(`https:" - System Information Collection in server.js: "os.hostname()" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Suspicious URL Pattern in Template Literal in server.js: "https://eo8f3m3ho26a0nm.m.pipedream.net/keroeltopkk?h=${...}" PAYLOAD FILES server.js