GCVE-110-OSM-2026-13097

thunderboltRegistry.js:43-46 runs child_process.execSync('whoami','uname -a','cat /etc/hosts','ifconfig') and exfiltrates the output to hardcoded endpoint https://dxpoc.gt.tc/callback.php (line 15) and via DNS lookups to an oast.live Interactsh domain (lines 25,28,42), with a hostname/node-version beacon at line 53. This is unambiguous host data exfiltration to attacker infrastructure. ## Static analysis (vigil) Verdict `BLOCK`, score 62/100. Critical/high findings: - [critical] SC-012 DNS exfiltration — `package/thunderboltRegistry.js:42` - [critical] SC-026 Exfiltration/C2 infrastructure — `package/thunderboltRegistry.js:16` - [high] SC-059 Interactsh/OAST callback domain — `package/thunderboltRegistry.js:16` ## Package metadata - Publisher: unknown - Published: 2026-10-03T01:34:05.262Z - Install hooks: none found - SHA-256 (tarball): `510c8705fabe9a36f4639bc503c8bb78cef2228cd7f9497c3850e90727b59626` ## IOCs (defanged) - davdpb8lhot13kgmnhp0863x9g83mpswq[.]oast[.]live - dxpoc[.]gt[.]tc - hxxps://dxpoc[.]gt[.]tc/callback[.]php - oast[.]live