GCVE-110-OSM-2026-13461

The package ships a tiny index.js that require()s a bundled ELF at prebuilds/linux-x64/metrics.node inside a swallow-all try/catch on module load. No C/C++ source, binding.gyp, or node-gyp/prebuild tooling is present, so the native binary cannot be rebuilt from source and its behavior is opaque to consumers. Strings extracted from the binary show it reads CI and cloud credential environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN, ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN) along with hostname, username and cwd, then opens a raw socket to the hardcoded host oob.s4yhii.com and issues POST /native HTTP/1.0 with a JSON body of the collected values. The addon daemonizes via fork+setsid to persist beyond the parent process. The destination host is unrelated to NestJS or any plausible publisher of a 'commons' utility. The package name mimics an internal-looking org scope and is published at version 999.0.6 with no repository and an UNLICENSED field, matching the dependency-confusion lure shape intended to win resolution against a private internal package of a similarly-named scope. Judge assessment: This package is a dependency-confusion attack targeting internal @galicia-toolkit-nestjs consumers. The OSV advisory (MAL-2026-17722) is strongly corroborated by the code evidence: index.js loads a bundled native binary at prebuilds/<platform>-<arch>/metrics.node via a try/catch-suppressed require, with no source, binding.gyp, or build tooling present — making the binary opaque and unreproducible. The advisory documents the binary exfiltrates CI/cloud credentials (AWS_ACCESS_KEY_ID, GITHUB_TOKEN, NPM_TOKEN, etc.), hostname, username, and cwd via a raw socket POST to oob.s4yhii.com, and daemonizes post-exec via fork+setsid. The publisher 's4yhii__' has a 38% malicious ratio across 26 checked packages with 10 confirmed malicious entries (including critical-severity siblings in the same @galicia-toolkit-nestjs scope), a burner account pattern, and version 999.0.8 is a textbook dependency-confusion inflated version number. The preinstall hook (`node index.js || true`) ensures silent execution on npm install. ENTRY index.js (install-hook: node index.js || true) - Install Hook Executes Local JS File in package.json EXFIL - System Information Collection in index.js: "os.platform()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js