GCVE-110-OSM-2026-12692

The package's postinstall script send_data.js runs automatically on npm install. It reads C:\temp\test.txt from the installer's filesystem and POSTs the contents over plain HTTP to a hardcoded remote endpoint at 35.178.197.251:8080. Package metadata ("Simplified test", author "Purple", UNLICENSED) is consistent with a PoC exfiltration harness rather than a legitimate library. ADDITIONAL FINDINGS - Brand New Package