GCVE-110-OSM-2026-12427

The package's package.json declares a preinstall script that runs callback.js on npm install. callback.js collects os.hostname(), os.userInfo(), os.platform(), the current working directory, and a timestamp, then enumerates process.env and selects keys matching /token|secret|key|pass|auth|api|aws/i (up to 10 entries). The collected data is POSTed via https.request to https://api.telegram.org/bot<BOT_TOKEN>/sendMessage using a hardcoded Telegram bot token and chat_id (bot 8636277735, chat_id 1064260758). The name mimics a legitimate vendor SDK but the package's only behavior is install-time reconnaissance and exfiltration of installer/build-host identity and credential-shaped environment variable names to an attacker-controlled Telegram channel — a dependency-confusion recon payload. ENTRY callback.js (install-hook: node callback.js 2>/dev/null || true) - Install Hook Executes Local JS File in package.json DESTINATION - 3 exfil (reconstructed, custom-c2, telegram-bot) - 2 c2 (telegramUsers, telegramChats) (values recorded in verified_iocs) EXFIL - Network Request in callback.js: "https.request(" - System Information Collection in callback.js: "os.userInfo()" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in callback.js: "https://api.telegram.org/bot8636277735:AAG-i_QzJ16XpWO7rm-W9IXp2Dq18cED8u4/sendM..." - Very New NPM Publisher Account PAYLOAD FILES callback.js TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @Nagubc_bot (id 8636277735) - 1 chat(s), 2 total member(s) observed - Threat-actor accounts: @sadfsdfgdt