GCVE-110-OSM-2026-2608

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution. Payload: preinstall.js Key findings: - OAST/Interactsh Exfiltration in preinstall.js: "webhook.site" - Install Hook Executes Local JS File in package.json: ""preinstall": "node preinstall.js"" - System Information Exfiltration in preinstall.js: "os.hostname(), user: os.userInfo().username, cwd: process.cwd() }); const option..." - Platform Detection with Data Collection in preinstall.js: "JSON.stringify({ package: package_name, hostname: os.hostname(), user: os" IOCs: - payloadFileHash: aa6c1c779dec272080caaa4770c7e83590cf33f53120ed54ca9858c12836b1bc