GCVE-110-OSM-2026-14049

On npm install, the package's declared postinstall script (postinstall.js) collects installer host fingerprint data — hostname, username, home directory, platform/arch/OS release, current working directory, install directory, DNS server list, non-internal network interface addresses, Node.js version, and npm_* environment values including npm_config_registry — and POSTs the collected JSON to https://collector.oob.s4yhii.com/_npm-poc/beacon. It additionally performs an out-of-band DNS lookup against a subdomain of oob.s4yhii.com (db03o8lag74hsugsg2j091t8mfcf437h3.oob.s4yhii.com) to confirm execution via DNS exfiltration. The destination is a hardcoded author-controlled domain, the behavior fires automatically at install time without consent, and the exfiltrated data includes npm_config_registry which can disclose an internal/private registry URL. A self-described 'PoC' or 'coordinated disclosure' framing does not change the fact that installer-identifying data and internal registry configuration leave the host to a third-party endpoint. ENTRY postinstall.js (install-hook: node ./postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Exfiltration in postinstall.js: "dns.getServers(), addresses: localAddresses(), timestamp: new Date().toISOString..." - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.userInfo()" - DNS Lookup in postinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern - Rapid Version Publishing PAYLOAD FILES postinstall.js