GCVE-110-OSM-2026-13433

The OpenSSF Package Analysis project identified 'test-account-portal-fe' @ 100.100.102 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. Judge assessment: This package is a classic dependency-confusion attack combined with DNS-based exfiltration via an OAST endpoint. The postinstall.js runs on install and constructs a DNS beacon by encoding the victim's hostname and package name into a subdomain query to `db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me`, which is an attacker-controlled out-of-band testing domain used to confirm successful installation on target systems. The inflated version `100.100.102` is a textbook dependency-confusion tactic to outrank an internal package named `test-account-portal-fe`. The publisher `dot2027` is a brand-new account (1 day old) with another already-flagged malicious package (`kmf-vendor-pack`), and the pattern of 10 similarly named packages (kmf-*, ksp-*, kwp-*) suggests a coordinated campaign targeting a specific organization's internal namespace. The OSV advisory MAL-2026-17748 is consistent with and corroborated by the actual code. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in postinstall.js: ".oast.me" - Suspicious Domain in postinstall.js: "oast.me" ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Has Other Malicious Packages PAYLOAD FILES postinstall.js