GCVE-110-OSM-2026-14054

The package's postinstall lifecycle script (postinstall.js) runs automatically on `npm install` and harvests installer host identifiers — hostname, username, uid/gid, home directory, non-internal network interfaces with MAC addresses and CIDRs, configured DNS servers, reverse-DNS internal FQDN, CPU/memory, the consumer package name/version/path, CI markers, npm_config_* values, and container runtime indicators — then POSTs the JSON report over HTTPS to the hardcoded host collector.oob.s4yhii.com at /_npm-poc/beacon and issues a DNS lookup for a label-prefixed subdomain of oob.s4yhii.com as an out-of-band beacon. The destination is not the installer's own infrastructure and is not caller-configurable. The `@coopeuch` scope combined with the 1.999.999 version has the shape of dependency-confusion targeting of a specific organization's internal namespace, in which `npm install` resolves this public package in place of an intended internal one and emits the fingerprint to the author's collector. ENTRY postinstall.js (install-hook: node ./postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.userInfo()" - DNS Lookup in postinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Has Other Malicious Packages - Rapid Version Publishing PAYLOAD FILES postinstall.js