GCVE-110-OSM-2026-14193

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, network activity. ENTRY dist/server.js (bin: ./dist/server.js) DESTINATION - 13 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in dist/feedback/validation.js: "oast.site" - OAST/Interactsh Exfiltration in src/feedback/validation.ts: "oast.site" - Data Encoding for Exfiltration in dist/auth/credentialsGuard.js: "encodeURIComponent(appId" - Data Encoding for Exfiltration in src/auth/credentialsGuard.ts: "encodeURIComponent(appId" - Network Request in dist/analytics/sessionTracking.js: "request({ method: "POST", hostname: url.hostname, port: url.port || (url.protoco..." - Network Request in dist/feedback/postFeedback.js: "request({ method: "POST", hostname: url.hostname, port: url.port || (url.protoco..." - Suspicious Domain in dist/feedback/validation.js: "oastify.com" - System Information Collection in dist/logcat/adb.js: "os.platform()" (+7 more) ADDITIONAL FINDINGS - Shell Command Execution in dist/logcat/adb.js: "require("child_process")" PAYLOAD FILES dist/feedback/validation.js (+ src/feedback/validation.ts, dist/analytics/sessionTracking.js)