GCVE-110-OSM-2026-13452

On module load, index.js unconditionally require()s a bundled native binary at prebuilds/<platform>-<arch>/metrics.node inside a try/catch that swallows errors. The ELF reads installer-side credential-grade environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN, ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN) along with hostname, uid, cwd, and uname, and POSTs a JSON payload to the hardcoded host oob.s4yhii.com via a raw 'POST /native HTTP/1.0' request. The binary calls fork+setsid to detach from the host process. The exfiltration destination is embedded inside the compiled addon rather than exposed in JavaScript, placing it beyond source-level inspection. The declared package scope (NestJS archetype toolkit) has no relationship to the destination host or to native-code execution, and the package ships no C/C++ sources corresponding to the shipped.node binary. ENTRY index.js (main: index.js) EXFIL - System Information Collection in index.js: "os.platform()" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js