GCVE-110-OSM-2026-12438

package.json declares preinstall and postinstall hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded bare IP 128.199.122.145 over plain HTTP, with the package name embedded in the query string (http://128.199.122.145/?test1df23). The beacon fires automatically at install time, leaking the installer's outbound IP and confirming successful execution on the installer's host to the operator of that IP. The package name and near-empty payload are consistent with a dependency-confusion or typosquat probe. ENTRY index.js (install-hook: node index.js --save-prod) - Install Hook Executes Local JS File in package.json - Preinstall Script in package.json DESTINATION - 2 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in index.js: "request(`http:" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in index.js: "http://128.199.122.145/?test1df23" - Very New NPM Publisher Account - Publisher Has Other Malicious Packages - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js