GCVE-110-OSM-2026-13929

On module load, index.js reads os.userInfo().username and issues an HTTPS GET to a hardcoded third-party collector at https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/, transmitting the installer's local username to an anonymous external endpoint. The same top-level code performs AWS Instance Metadata Service reconnaissance against 169.254.169.254: it PUTs /latest/api/token to obtain an IMDSv2 session token and then GETs /latest/meta-data/iam/security-credentials/ to enumerate the IAM role attached to the host. Both behaviors fire automatically when the package is required, with no caller action. ENTRY index.js (main: index.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: "webhook.site" - System Information Exfiltration in index.js: "os.userInfo().username); try{https.get('https://webhook.site/553dad0e-c841-46a8-..." - Network Request in index.js: "http.request(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES index.js