GCVE-110-OSM-2026-13434

This is a dependency-confusion attack. The postinstall.js script executes on install and performs DNS-based exfiltration by encoding the victim's hostname and npm package name into a DNS lookup subdomain targeting the attacker-controlled OAST endpoint `db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me`. The inflated version number (100.100.102) is a classic dependency-confusion signal designed to outrank an internal private package. The publisher 'dot2027' (account age ~1 day) has already had two other packages flagged as malicious (kmf-vendor-pack at medium severity, test-account-portal-fe at critical severity), establishing a clear pattern of malicious publishing. The code is unambiguous: hostname and package name are concatenated into a DNS callback subdomain, giving the attacker beacon confirmation of installation on victim systems. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in postinstall.js: ".oast.me" - Suspicious Domain in postinstall.js: "oast.me" ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Has Other Malicious Packages PAYLOAD FILES postinstall.js