GCVE-110-OSM-2026-14191

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution. ENTRY beacon.js (install-hook: node beacon.js preinstall) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in beacon.js: ".oast.pro" - Data Encoding for Exfiltration in beacon.js: "encodeURIComponent(label), function (r) { r.resume(); }).on('error', function ()..." - Network Request in beacon.js: "https.get(" - System Information Collection in beacon.js: "os.userInfo()" - DNS Lookup in beacon.js: "dns.lookup(" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES beacon.js