GCVE-110-OSM-2026-1250

Reconnaissance package that exfiltrates the victim machine's hostname and current username to an attacker-controlled OAST domain (jwbwnumwokihfzlekgchergcdtlixsguo.oast.fun) via HTTPS POST in a postinstall script. The package has no legitimate functionality — install.js is the only meaningful file besides package.json, and it performs no useful work. Three versions were published within 14 minutes on 2026-04-01, each adding minor variations while preserving the exfil logic. package.json declares 'postinstall: node install.js'. install.js collects os.hostname() and os.userInfo().username, constructs a JSON payload with a 'source: public npm registry' marker, and POSTs it to https://jwbwnumwokihfzlekgchergcdtlixsguo.oast.fun with Content-Type: application/json. Request has a 5-second timeout. No error handling exposed to user — failures are silently swallowed. The comment '// Send the payload to the attacker's server' is left verbatim in the published source, confirming intent.