GCVE-110-OSM-2026-13857

Importing the package triggers encrypted DNS tunneling of the machine hostname and current username to an attacker-controlled domain. The package presents a classic dependency confusion / security-researcher PoC pattern: namespace prefix 'nwfp' (likely an internal organization name), publisher username 'nullcautiontest' with email 'nullsec_caution@pm.me' — both names include explicit caution/test signals common in bounty-hunter test packages. The entrypoint silently loads a telemetry module (`try { require('./lib/telemetry'); } catch (_) {}`) which collects `os.userInfo()` and `os.hostname()`, the standard fingerprint collected in dependency confusion proofs-of-concept. Critically, no exfil endpoint (webhook, HTTP POST target, DNS callback) was recovered in the IOCs or exfil analysis, so we cannot confirm data leaves the host; however, the absence of a detected endpoint may simply mean the exfil logic in `lib/telemetry.js` was not fully analyzed or uses a runtime-computed URL. The combination of a <1-day-old account, silent telemetry require, system fingerprinting, and 'nwfp' private-namespace prefix is consistent with a dependency confusion test but warrants manual inspection of the full `lib/telemetry.js` content before clearing. ENTRY index.js (main: index.js) EXFIL - System Information Collection in lib/telemetry.js: "os.userInfo()" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES lib/telemetry.js