GCVE-110-OSM-2026-13462

The package's main entry (index.js) loads a prebuilt native addon (prebuilds/<platform>-<arch>/metrics.node) inside a try/catch on require. The ELF reads CI and cloud credentials from the environment — AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN, ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN — together with host identity and working-directory fields (gethostname, getuid, getpwuid, getcwd, uname) and sends them in a JSON body (fields src, pkg, h, u, os, arch, rel, cwd, e) via a raw socket HTTP POST to oob.s4yhii.com (POST /native HTTP/1.0). The addon imports fork and setsid to daemonize and uses hand-rolled socket/connect/send rather than Node's HTTP API, bypassing Node-level network observability. The package name scope (@galicia-toolkit-nestjs) and implausibly high version (999.0.5) are consistent with a dependency-confusion payload targeting an internal package name. Installing or requiring this package in any environment carrying CI, npm publish, GitHub Actions, or AWS credentials results in those secrets being transmitted to the hardcoded attacker endpoint. Judge assessment: This is a dependency-confusion attack package with a native addon (prebuilds/<platform>-<arch>/metrics.node) that exfiltrates CI/cloud credentials to an attacker-controlled endpoint. The index.js preinstall entrypoint loads the .node binary via dynamic require(binding) after fingerprinting the OS platform and arch, and the OSV advisory (MAL-2026-17723) confirms the binary reads AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, NPM_TOKEN, ACTIONS_RUNTIME_TOKEN and other secrets and POSTs them to oob.s4yhii.com/native using a raw socket to bypass Node-level network observability. The inflated version (999.0.6) is a textbook dependency-confusion tactic to outrank an internal @galicia-toolkit-nestjs/paas package. Publisher s4yhii__ has a 38% malicious package ratio across 27 packages including critical-severity findings on sibling packages like @galicia-toolkit-nestjs-20/paas and @galicia-toolkit-nestjs-20/commons, confirming a sustained malicious campaign. The attacker model is credential harvesting from CI/CD environments (GitHub Actions, AWS, npm publish pipelines). ENTRY index.js (install-hook: node index.js || true) - Install Hook Executes Local JS File in package.json EXFIL - System Information Collection in index.js: "os.platform()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js