GCVE-110-OSM-2026-12440

Package declares both preinstall and postinstall lifecycle hooks that execute index.js on `npm install`. index.js issues an HTTP GET to the hardcoded bare IP 128.199.122.145 over plain HTTP, embedding the package name in the query string (`http://128.199.122.145/?test1hh235`). Manifest shape is consistent with a dependency-confusion reconnaissance probe: version 99.99.99 (implausibly high to win resolution against an internal package), empty description, and a typo-prone name. The beacon fires automatically during install and signals successful resolution/installation to an attacker-controlled host, confirming the target environment for follow-on attack. ENTRY index.js (install-hook: node index.js --save-prod) - Install Hook Executes Local JS File in package.json - Preinstall Script in package.json DESTINATION - 2 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in index.js: "request(`http:" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in index.js: "http://128.199.122.145/?test1hh235" PAYLOAD FILES index.js