GCVE-110-OSM-2026-13928

Version 2.0.4 of this npm animation package contains an optional registration entry point that collects detailed host, user, and process information and submits it to an externally controlled Loggly account. The default CSS exports are inert, but invoking the registration export or the included OS logging script causes system reconnaissance data to leave the host. No secondary payload download, persistence, subprocess execution, dynamic code execution, or blockchain activity was found in the supplied artifact. The ./register export resolves to scripts/register.cjs. When called, it creates a Winston logger backed by winston-loggly-bulk, collects the OS platform, type, release, architecture, hostname, CPU count and model, total and free memory, uptime, load averages, home directory, temporary directory, username, current working directory, process ID, package version, and timestamp, then submits a JSON package_load event. A global flag named __tailwindAnimateCssLoadLogged suppresses repeated uploads in the same JavaScript realm. The log:os npm script sends a similar Host OS snapshot and waits up to ten seconds for the transport to finish. The Loggly account and customer token are split and Base64-encoded in scripts/loggly-logger.cjs. The exact HTTP endpoint, headers, retry behavior, and response handling remain unresolved because the winston-loggly-bulk dependency source was not present. The supplied first-party files contain no downloader, file-write primitive, embedded executable, shell launcher, persistence mechanism, dynamic evaluation, or response-to-code path. The prepare lifecycle entry invokes simple-git-hooks, whose dependency implementation was not supplied. ENTRY src/tailwind-animate.css (main: ./src/tailwind-animate.css) EXFIL - System Information Collection in scripts/loggly-logger.cjs: "os.userInfo()" OBFUSCATION - Decoded Base64 Content in scripts/loggly-logger.cjs (x2) PAYLOAD FILES scripts/loggly-logger.cjs