GCVE-110-OSM-2026-13456

The package declares scripts.preinstall `node index.js || true`, and index.js (also the main entry) require()s a platform-specific prebuilt native addon at prebuilds/<platform>-<arch>/metrics.node. The native binary reads a curated list of CI/cloud credential environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN, ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, AZURE_DEVOPS_EXT_PAT, and similar), together with hostname, user, OS/arch, and cwd (gethostname/getpwuid/uname/getcwd on Linux; GetUserNameA/GetComputerNameA/GetCurrentDirectoryA on Windows). The collected values are serialized as a JSON body (`{"src":"native","pkg":...,"e":{...}}`) and sent via a raw TCP socket as `POST /native HTTP/1.0` to the hardcoded host oob.s4yhii.com. The exported NestJS surface (forRoot/createLogger) is empty stub code with no real functionality, and a nested manifest at src/archetype/package.json contains the self-identifying marker `s4yhii-poc-2026-10-09` and contact `jesusitpro22@gmail.com`, matching the exfil host. The harmful code path fires automatically on `npm install` via preinstall and again on any require() of the package. Judge assessment: This package implements a credential-theft supply chain attack that fires automatically on `npm install` via the preinstall hook (`node index.js || true`). The index.js loads a platform-specific native addon (`prebuilds/<platform>-<arch>/metrics.node`) which, per the OSV advisory (MAL-2026-17730) — corroborated by the system-info collection finding and the `os.platform()`/`os.arch()` logic visible in the entrypoint — harvests cloud and CI credentials (AWS_ACCESS_KEY_ID, GITHUB_TOKEN, NPM_TOKEN, etc.) along with hostname/user/cwd and exfiltrates them via raw TCP POST to `oob.s4yhii.com`. The publisher `s4yhii__` is a burner account (≈0 days old) that has already had 6 packages confirmed malicious at high/critical severity, the exfil domain `oob.s4yhii.com` matches the publisher's own handle, and the package's NestJS surface is entirely stub code with no real functionality. The self-identifying marker `s4yhii-poc-2026-10-09` in a nested manifest confirms this is intentional attacker infrastructure, not an accidental misconfiguration. ENTRY index.js (install-hook: node index.js || true) - Install Hook Executes Local JS File in package.json EXFIL - System Information Collection in index.js: "os.platform()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js