GCVE-110-OSM-2026-12425

package.json wires callback.js to both the preinstall and postinstall lifecycle hooks, so `npm install siriusbeyond` executes it automatically. callback.js collects hostname, username, platform, cwd, home directory, uid/gid/pid, network interface details, CI/cloud environment indicators, and a list of process.env variable names matching approximately 35 credential-shaped regexes (token, secret, key, password, aws, azure, gcp, npm, git, ssh, jwt, database, stripe, slack, discord, webhook, etc.), together with existence checks for.env,.npmrc, credentials, and secrets.json in the working directory. The collected payload is POSTed to api.telegram.org using a hardcoded bot token and chat id (chat 1064260758). A secondary channel base64-encodes a JSON blob of host, user, and CI fields and issues a dns.resolve() against `<base64>.dc-callback.example.com`, providing a DNS-tunnel exfil path when outbound HTTPS is blocked. Even though variable values are not sent, the disclosed variable names and credential-file inventory identify which secrets the installer holds and enable targeted follow-on attack. ENTRY callback.js (install-hook: node callback.js 2>/dev/null || true) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 3 exfil (telegram-bot, custom-c2) - 2 c2 (telegramUsers, telegramChats) (values recorded in verified_iocs) EXFIL - Git Configuration Access in callback.js: ".git/config" - Network Request in callback.js: "https.request(" - System Information Collection in callback.js: "os.userInfo()" - DNS Lookup in callback.js: "dns.resolve(" ADDITIONAL FINDINGS - Platform Detection with Data Collection in callback.js: "JSON.stringify({ h: payload.hos" - Very New NPM Publisher Account PAYLOAD FILES callback.js TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @Nagubc_bot (id 8636277735) - 1 chat(s), 2 total member(s) observed - Threat-actor accounts: @sadfsdfgdt