GCVE-110-OSM-2026-13432

This package implements a classic install-time beacon: `beacon.cjs` runs on postinstall, collects hostname, install path, cwd, and Node version, then POSTs that data to a hardcoded attacker-controlled IP `http://185.158.107.175:8787/_ah/dc`. The comment claiming 'no data beyond machine/package metadata' is the attacker's own cover story — exfiltrating hostname and install path on install is the first stage of a supply-chain reconnaissance attack. The publisher `xwise898` has a 100% malicious ratio across all 5 previously checked packages (another-very-long-name, cloudflare_module, nitro-bundled-dep, nitro-cjs-requirer, some-very-long-package-name), all rated high severity, establishing a clear pattern of serial malicious publishing from a brand-new account created less than a day ago. The attacker email `0xwise@wearehackerone.com` is almost certainly spoofed to appear as a bug bounty researcher, but the C2 IP and the identical publisher pattern across six packages confirm adversarial intent rather than a legitimate security test. ENTRY beacon.cjs (install-hook: node beacon.cjs) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in beacon.cjs: "request({ hostname: u.hostname, port: u.port || (u.protocol === 'https:" - Suspicious Domain in beacon.cjs: "http://185.158.107.175" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES beacon.cjs