GCVE-110-OSM-2026-13458

The package ships a tiny JavaScript stub at index.js that silently require()s a compiled native addon at prebuilds/linux-x64/metrics.node inside a try/catch that suppresses errors. On load, the addon reads a hardcoded list of credential-bearing environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS session token, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, SYSTEM_ACCESSTOKEN) along with hostname, user, cwd, and OS/arch, and sends them as a JSON body via a raw TCP socket (gethostbyname/socket/connect/send) in a 'POST /native HTTP/1.0' request to the hardcoded external host oob.s4yhii.com. The addon also imports fork and setsid, consistent with detaching into a background process so the exfiltration channel survives beyond the host Node process. The compiled ELF is the entire payload; the JS wrapper exposes no form-related functionality matching the stated 'form module' description. The package manifest (scoped name @brick-v2/form, inflated version 999.0.1, UNLICENSED, minimal metadata) matches the dependency-confusion shape used to outrank an internal private-registry package of the same scope. Judge assessment: This package is a dependency-confusion attack targeting internal @brick-v2/form consumers. The index.js preinstall entrypoint loads a compiled native addon (prebuilds/<platform>/metrics.node) inside a suppressed try/catch — the JS wrapper exposes no legitimate form functionality. Per the OSV advisory (MAL-2026-17716), the native ELF addon performs credential exfiltration via raw TCP socket to oob.s4yhii.com, harvesting AWS keys, GitHub/NPM tokens, CI tokens, hostname, user, and CWD. The version 999.0.3 inflated major version confirms dependency-confusion intent. The publisher 's4yhii__' has a 38% malicious package ratio across 26 checked packages including multiple critical-severity entries (@brick-v2/brand, @galicia-toolkit-nestjs-20/commons, @galicia-toolkit-nestjs-20/paas) and a near-zero-age account, consistent with a coordinated supply-chain attacker operating under a burner identity. ENTRY index.js (install-hook: node index.js || true) - Install Hook Executes Local JS File in package.json EXFIL - System Information Collection in index.js: "os.platform()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js