GCVE-110-OSM-2026-13435

Malicious npm package used in a likely dependency-confusion campaign. Its install-time hook loads a native Linux addon that silently exfiltrates system and npm environment metadata to attacker-controlled infrastructure. Version 100.100.101 registers a postinstall script that loads prebuilds/linux-x64/addon.node. The ELF init array automatically invokes a constructor which forks a child process, collects the hostname, current OS username, npm_package_name, and npm_config_registry, and sends them in an application/x-www-form-urlencoded HTTP POST request. It attempts TCP port 80 first and falls back to port 443, but uses plaintext HTTP on both ports. The server response is never read. Static analysis found no additional payload download, response-to-code behavior, command execution, persistence, dropped files, blockchain activity, or secondary stage. The native addon is Linux x86-64 only; loading errors are silently suppressed by the JavaScript wrapper.