GCVE-110-OSM-2026-14443

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution. ENTRY preinstall.js (install-hook: node preinstall.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in preinstall.js: "webhook.site" - Network Request in preinstall.js: "request({ hostname: url.hostname, port: url.port || (url.protocol === 'https:" - System Information Collection in preinstall.js: "os.hostname()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in preinstall.js: "JSON.stringify({ alert: 'dependency-confusion', package: 'jshelperdependenceny',..." - Very New NPM Publisher Account PAYLOAD FILES preinstall.js