GCVE-110-OSM-2026-14448

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY index.cjs (install-hook: node ./index.cjs) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in index.cjs: "process.env.GITLAB_CI ? "gitlab-ci" : process.env.TF_BUILD ? "azure-pipelines" :..." - OAST/Interactsh Exfiltration in index.cjs: "webhook.site" - System Information Exfiltration in index.cjs: "os.hostname(), home_directory: os.homedir(), platform: process.platform, ci_prov..." - Network Request in index.cjs: "https.request(" - System Information Collection in index.cjs: "os.hostname()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Platform Detection with Data Collection in index.cjs: "JSON.stringify({ test_id: "UNIQUE-TEST-ID", hostname: os.hostname(), home_direct..." - Brand New Package - Rapid Version Publishing PAYLOAD FILES index.cjs