GCVE-110-OSM-2026-14372

This is a security researcher style PoC that uses nested url and github dependencies to hide the final payload which exfiltrates: • Node.js version • Home-directory path, commonly exposing the local username • Current working directory • Operating-system platform • CPU architecture ENTRY - URL-Based Dependency in package.json: ""dependencies": { "claims-ac1": "^1.0.0", "node-ac2": "https://github.com/GamerD..." - URL-Based Dependency in [node-ac2] package.json: ""dependencies": { "node-ac3": "https://github.com/GamerD11/ping_test/raw/main/no..." ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES [node-ac2] package.json