GCVE-110-OSM-2026-2552

Malicious package detected. Behaviors: data exfiltration, obfuscated code, install-time execution. Payload: lib/env-check.js Secondary files: lib/reporter.js Key findings: - HTTP Data Exfiltration in lib/env-check.js: "os.userInfo().username, _p: os.platform(), _a: os.arch(), _d: ..." - Platform Detection with Data Collection in lib/env-check.js: "JSON.stringify({ _n: process.env.npm_package_name, _v: process.env.n..." - HTTP Data Exfiltration in lib/reporter.js: "os.hostname(), _u: os.userInfo().username, _p: os.platform(), ..." - Platform Detection with Data Collection in lib/reporter.js: "JSON.stringify({ _n: '@shopee-order/declarative-tracker', _c: ctx ||..." - Install Hook Executes Local JS File in package.json: ""postinstall": "node lib/env-check.js"" IOCs: - payloadFileHash: dcb0e55684c2b3a188946cc0eaca05b223941bc62fd09743e338272b39e7b1e5