GCVE-110-OSM-2026-12512

On `npm install`, the package's postinstall hook runs `node index.js`, which collects installer host identifiers (os.hostname(), os.userInfo().username, os.platform(), architecture, cwd, node version, npm_lifecycle_event) and POSTs them as JSON to a hardcoded third-party collector at https://webhook.site/d9bc4bcc-ce74-4193-ae4e-96d234bb2220. The payload includes a `src: 'loMesb'` tag consistent with a campaign identifier used to correlate exfiltrated data across victims. The @woodpecker-web-shared/components scope/name has no legitimate reason to transmit installer identity to an anonymous webhook collector at install time, and the behavior fires automatically without user interaction. This is a recon beacon consistent with a dependency-confusion or typosquat lure. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in index.js: "process.env.npm_lifecycle_event || null, src: 'loMesbx', }; } function beacon(da..." - OAST/Interactsh Exfiltration in index.js: "webhook.site" - System Information Exfiltration in index.js: "os.userInfo().username, platform: os.platform(), arch: os.arch(), cwd: process.c..." - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES index.js