GCVE-110-OSM-2026-13386

The OpenSSF Package Analysis project identified '@myorder-frontend-commons/analytics' @ 99.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. ENTRY poc.js (install-hook: node poc.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in poc.js: ".oast.fun" - Data Encoding for Exfiltration in poc.js: "encodeURIComponent(k)+'='+encodeURIComponent(String(info[k]));}).join" - Network Request in poc.js: "http.get(" - System Information Collection in poc.js: "os.userInfo()" - Suspicious Domain in poc.js: "oast.fun" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES poc.js