GCVE-110-OSM-2026-12441

Package test1sdsd2@99.99.99 declares preinstall and postinstall hooks in package.json that execute index.js on `npm install`. index.js performs an HTTP GET to the hardcoded bare IP http://128.199.122.145/?test1sdsd2, embedding the package name in the query string, which confirms code execution on the installer's machine and leaks install-signal (package name, implicit source IP, timing) to an attacker-controlled endpoint. The version number 99.99.99 combined with the beacon shape is the canonical dependency-confusion probe pattern used to detect resolution of an internal package name against a public registry. The package ships no legitimate library functionality. ENTRY index.js (install-hook: node index.js --save-prod) - Install Hook Executes Local JS File in package.json - Preinstall Script in package.json DESTINATION - 2 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in index.js: "request(`http:" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in index.js: "http://128.199.122.145/?test1sdsd2" PAYLOAD FILES index.js