GCVE-110-OSM-2026-12452

The package's preinstall script (scripts.preinstall = 'node index.js') runs automatically on npm install and collects os.userInfo().username and os.hostname(), then issues a dns.lookup against a subdomain of 31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site with the username and hostname embedded in the queried label. This is a DNS-based exfiltration beacon: installing the package transmits installer host identifiers to a non-first-party canary domain over DNS resolution at install time. The version number 99.99.99 and package name shape are consistent with a dependency-confusion lure targeting an internal package name. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json EXFIL - System Information Collection in index.js: "os.userInfo()" - DNS Lookup in index.js: "dns.lookup(" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js