GCVE-110-OSM-2026-13639

This package executes on install via a preinstall hook (`node index.js`) and immediately contacts a custom C2 endpoint `https://realwbx.com/ip.php` with a hardcoded Authorization token `fa79878bc2cfb48bd5127ae26fb661b1`. While the current payload only passes a hardcoded IP (8.8.8.8), the pattern — attacker-controlled domain, unique auth token per package family, preinstall execution — is consistent with an IP/environment reconnaissance infrastructure used across 9 packages from the same publisher. The publisher `conx3993` has a malicious ratio of 0.625 (5 of 8 checked packages already reported as high-severity malicious), all published within 15 days, confirming a systematic campaign. The OSV advisory MAL-2026-17896 corroborates this assessment and the code matches exactly what is described. The attacker model is infrastructure fingerprinting/victim reconnaissance as a precursor to further payloads. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in index.js: "https.request(" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Brand New Package - Rapid Version Publishing PAYLOAD FILES index.js