GCVE-110-OSM-2026-13896

This is a bug bounty style package that loads a tarball from an AWS S3 bucket. That tarball is a ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "@platform-services/hrm-mfe-core": "https://s3.amazonaws.com/s..." - Install Hook Executes Local JS File in [@platform-services/hrm-mfe-core] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" DESTINATION - 1 loader (domains) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in [@platform-services/hrm-mfe-core] test.js: "oastify.com" - Network Request in [@platform-services/hrm-mfe-core] index.js: "http.request(" - System Information Collection in [@platform-services/hrm-mfe-core] test.js: "os.userInfo()" - Suspicious Domain in [@platform-services/hrm-mfe-core] test.js: "oastify.com" OBFUSCATION - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES [@platform-services/hrm-mfe-core] test.js