GCVE-110-OSM-2026-13457

package.json declares a preinstall hook `node index.js || true` that loads a prebuilt native addon at prebuilds/<platform>-<arch>/metrics.node. The addon reads credential-grade environment variables (AWS_SECRET_ACCESS_KEY and other AWS_*, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN, ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, AZURE_DEVOPS_EXT_PAT) and host identifiers (hostname via gethostname/GetComputerNameA, username via getpwuid/GetUserNameA, uname release, cwd, package name), serializes them into a JSON payload of shape `{"src":"native","pkg":...,"h":...,"u":...,"os":...,"arch":...,"rel":...,"cwd":...,"e":{...}}`, and transmits it via a raw TCP socket (socket/connect/send, with setsid+fork daemonization on Linux) to the hardcoded host oob.s4yhii.com using `POST /native HTTP/1.0`. The same exfiltration behavior is present in both the linux-x64 and win32-x64 prebuilt binaries. The JavaScript entry point exports only inert NestJS-style `forRoot` / `createLogger` placeholders; the entire operational behavior resides in the opaque native binary. The package is published under the private-looking scope `@brick-v2` at version `999.0.3`, a version-inflation shape consistent with dependency-confusion resolution against an internal `@brick-v2` scope. Judge assessment: This package implements a dependency-confusion attack under the @brick-v2 scope at inflated version 999.0.3, with a preinstall hook executing index.js that loads a prebuilt native addon (prebuilds/<platform>-<arch>/metrics.node). The OSV advisory MAL-2026-17714, corroborated by the index.js content visible in the entrypoint, confirms the native binary exfiltrates AWS credentials (AWS_SECRET_ACCESS_KEY, AWS_*), CI/CD tokens (GITHUB_TOKEN, NPM_TOKEN, ACTIONS_RUNTIME_TOKEN, AZURE_DEVOPS_EXT_PAT), and host identifiers via a raw TCP socket to the hardcoded C2 host oob.s4yhii.com via POST /native HTTP/1.0. The publisher 's4yhii__' is a burner account (~0 days old) with a publisherMaliciousRatio of 0.31 across 26 checked packages (8 already flagged as malicious including critical-severity siblings @galicia-toolkit-nestjs-20/commons and @galicia-toolkit-nestjs-20/paas), and also operates the @s4yhiitestpoc namespace used for apparent OAST/exfil testing infrastructure. The operational payload is entirely concealed in the opaque native binary, with the JS entry point serving only as an innocuous-looking NestJS shim — a deliberate evasion technique consistent with the Lazarus/Contagious Interview native-addon supply-chain model. ENTRY index.js (install-hook: node index.js || true) - Install Hook Executes Local JS File in package.json EXFIL - System Information Collection in index.js: "os.platform()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js