GCVE-110-OSM-2026-13533

The package presents a benign npm entrypoint (`lib/index.js` is a trivial greeting function) while the `build/index.html` file contains a sophisticated browser fingerprinting payload that exfiltrates environment data to an attacker-controlled Alibaba OSS endpoint. The `ping()` function collects WebDriver detection (`wd`), CEF/Electron detection (`cef: typeof window.cefQuery`), detailed Chrome version fingerprinting via 19 API probes, high-entropy UA values (architecture, platform version, full browser version list), WebAssembly support, and eval capability — a profile consistent with targeting specific developer environments or CI pipelines rather than general analytics. The embedded TurboFan JIT bug probe (chk-15903) and the console.log verdict-capture hook further indicate active exploitation research, not a demo widget. npm has already flagged this as a security holding and an OSV advisory (MAL-2026-17876) exists; the code-level evidence corroborates the advisory's concern, though the claimed full compromise overstates what is visible here (no credential theft or install hooks were found — the malicious payload only executes in a browser). ENTRY lib/index.js (main: lib/index.js) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in build/index.html: "encodeURIComponent(k) + '=' + encodeURIComponent(q(params[k" ADDITIONAL FINDINGS - Brand New Package PAYLOAD FILES build/index.html