GCVE-110-OSM-2026-13854

This package is a supply-chain attack disguised as a security research marker. The postinstall hook executes collect.js, which runs shell commands (ls -A ~, ls -A .), reads .npmrc, .gitconfig, .config/gh existence, collects all environment variable names via Object.keys(process.env), and POSTs the collected metadata to webhook.site/f18b2445-73d1-478a-9d3f-1cb21a407c61. The self-labeling as 'security research POC' and HackerOne email are common social engineering tactics to avoid takedown; the actual behavior — exfiltrating directory listings, dotfile presence, environment variable names, username, and kernel version to an external webhook on install — is functionally indistinguishable from a real supply-chain implant. The .gitconfig and .npmrc presence checks combined with full env key enumeration suggests reconnaissance targeting developer identity and CI/CD token discovery. The account is less than 2 hours old with a single package, consistent with a throw-away exfil account. ENTRY collect.js (install-hook: node collect.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in collect.js: "process.env).sort().join(','); } catch (e) { meta.err = String(e).slice(0,120); ..." - OAST/Interactsh Exfiltration in collect.js: "webhook.site" - Git Configuration Access in collect.js: ".gitconfig" - Network Request in collect.js: "https.request(" - System Information Collection in collect.js: "os.userInfo()" ADDITIONAL FINDINGS - Shell Command Execution in collect.js: "child_process').exec" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES collect.js