GCVE-110-OSM-2026-13409

On npm install, this package's postinstall script (node postinstall.js) hex-encodes the installer's hostname, current working directory, platform/arch/Node version, and USER/USERNAME/LOGNAME values, and emits DNS queries whose subdomains encode that data under the hardcoded author-controlled zone oob.s4yhii.com, using an authoritative resolver as an out-of-band exfiltration channel. The package name and the version number 999.0.3 are consistent with a dependency-confusion payload shape designed to win resolution against an internal @galicia-toolkit/error-master package. The DNS-tunnel beacon fires automatically at install time with no installer action beyond npm install, leaking host and user identifiers to the attacker's authoritative nameserver. ENTRY postinstall.js (install-hook: node postinstall.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - 5 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in postinstall.js: "os.hostname()" - DNS Lookup in postinstall.js: "dns.resolve(" PAYLOAD FILES postinstall.js