GCVE-110-OSM-2026-13397

On `npm install`, package.json `scripts.postinstall` runs `node beacon.cjs`, which POSTs a JSON payload containing the installer's hostname (`os.hostname()`), install path (`__dirname`), current working directory (`process.cwd()`), Node version, and package identifier over plain HTTP to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`. The same beacon is re-triggered at import time: `index.js` (the declared `main`) calls `require('./beacon.cjs').fire()` and then exports a `Proxy` whose `get` trap returns a no-op for any member access, so consumers importing arbitrary names from the package continue past the callback. The dual trigger ensures the callback fires even when lifecycle scripts are suppressed (e.g. `npm install --ignore-scripts`), and the Proxy shim conceals that the package provides no legitimate functionality. The destination is a bare IPv4 address on a non-standard port unrelated to any declared publisher, and the transport is unencrypted. ENTRY beacon.cjs (install-hook: node beacon.cjs) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in beacon.cjs: "request({ hostname: u.hostname, port: u.port || (u.protocol === 'https:" - Suspicious Domain in beacon.cjs: "http://185.158.107.175" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern - Rapid Version Publishing PAYLOAD FILES beacon.cjs