GCVE-110-OSM-2026-13464

package.json declares a preinstall hook `node index.js || true`, which require()'s a bundled native addon at prebuilds/<platform>-<arch>/metrics.node. On N-API registration the addon reads AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN, ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, and AZURE_DEVOPS_EXT_PAT, collects hostname/user/cwd, and POSTs the data as JSON to http://oob.s4yhii.com/native. The payload is concealed inside a compiled.node binary named `metrics` (symbol `do_report`, cover-story env var `_METRICS_PKG`, JSON field `src:native`) with no corresponding C/C++ source shipped; the package otherwise advertises itself as a NestJS commons library, and shipping a native socket-opening module is inconsistent with that purpose. The implausibly high version `999.0.3` on a `@...-lite/commons` scope is consistent with a dependency-confusion lure targeting an internal package name. Judge assessment: This package implements a classic dependency-confusion attack combined with a native addon credential harvester. The preinstall hook (`node index.js || true`) loads a compiled native binary at `prebuilds/<platform>-<arch>/metrics.node` — the platform fingerprinting via `os.platform()` and `os.arch()` is the mechanism for selecting the correct binary, not a benign pattern. The OSV advisory (MAL-2026-17729) details the native addon's behavior: on N-API registration it reads CI/CD and cloud credentials (AWS keys, GITHUB_TOKEN, NPM_TOKEN, AZURE_DEVOPS_EXT_PAT, etc.) and POSTs them to `http://oob.s4yhii.com/native`. The version `999.0.3` is the canonical dependency-confusion inflation pattern, designed to outrank an internal `@galicia-toolkit-nestjs-20-lite/commons` package. The publisher `s4yhii__` has a 38% malicious ratio across 26 checked packages including multiple critical-severity entries, and the account is less than one day old — a burner account executing a coordinated supply-chain campaign consistent with the Contagious Interview / DPRK credential-theft attacker model. The advisory's claims are fully corroborated by the entrypoint code visible in the scan. ENTRY index.js (install-hook: node index.js || true) - Install Hook Executes Local JS File in package.json EXFIL - System Information Collection in index.js: "os.platform()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES index.js