GCVE-110-OSM-2026-2553

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution. Payload: preinstall.js Key findings: - OAST/Interactsh Exfiltration in preinstall.js: "webhook.site" - Install Hook Executes Local JS File in package.json: ""preinstall": "node preinstall.js"" - System Information Exfiltration in preinstall.js: "os.hostname(), user: os.userInfo().username, cwd: process.cwd() }); con..." - Platform Detection with Data Collection in preinstall.js: "JSON.stringify({ package: package_name, hostname: os.hostname(), use..." IOCs: - urls: https://webhook.site/placeholder - webhookServices: https://webhook.site/placeholder - payloadFileHash: 239ce07647bff82e2200dce52e208d46b9a54e63318d5442733d3a793a4b6b00