GCVE-110-OSM-2026-13501

This package executes on install and exfiltrates a system fingerprint — hostname, username, homedir, network interfaces, DNS servers, npm registry configuration including private scoped registry overrides — via HTTPS POST to `collector.oob.s4yhii.com` with a secondary DNS covert channel to `db03o8lag74hsugsg2j091t8mfcf437h3.oob.s4yhii.com`. The 'coordinated vulnerability disclosure' self-description in the code comments is a social engineering tactic, not a legitimate exemption: a genuine bug bounty researcher does not operate 18 other packages rated critical or high malicious by OSM (publisherMaliciousRatio 0.69), many of which target specific organization namespaces (`@galicia-toolkit-nestjs/*`, `@brick-v2/*`) consistent with targeted dependency confusion attacks against Banco Galicia and a private UI library. The attacker model is dependency confusion supply-chain intrusion: publish to the public registry under private organization namespaces, beacon on install to identify which victim pipelines resolved the package, and collect enough environment detail (private registry URL via `npm_config_registry`, network topology, working directory) to profile the target for follow-on action. The 'only npm_* vars' allowlist framing obscures that `npm_config_@scope:registry` is explicitly harvested to detect private registry configurations — exactly the intelligence dependency confusion attackers seek. ENTRY postinstall.js (install-hook: node ./postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Exfiltration in postinstall.js: "dns.getServers(), addresses: localAddresses(), timestamp: new Date().toISOString..." - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.userInfo()" - DNS Lookup in postinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern - Rapid Version Publishing PAYLOAD FILES postinstall.js