GCVE-110-OSM-2026-12511

Package declares `scripts.install: node index.js`, which loads runtime/support/telemetry/probe/impl.js. That module reads the installer's OS username (`os.userInfo().username`), hostname (`os.hostname()`), and current working directory basename (`process.cwd()`), joins them with a timestamp and the prefix `bxabis` under the suffix `oob.algamil7x.xyz`, and issues a `dns.resolve4` lookup on the composed name — a DNS-tunnel exfiltration of installer host identity to an attacker-controlled domain. The behavior fires automatically on `npm install` and again on `require`. The module names, method references (`_load('os')`, `_load('dns')`, `userInfo`, `hostname`, `cwd`, `resolve4`), the prefix `bxabis`, and the destination domain are all reconstructed from char-code hex arrays, and the surrounding files carry `telemetry`/`connectivity probe` cover-story comments. The destination is unrelated to any legitimate endpoint of a smart-contract ABI library. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Obfuscation (osm-deobfuscator): unknown in runtime/support/telemetry/probe/c7a1f4.js ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Has Other Malicious Packages