GCVE-110-OSM-2026-2630

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, network activity, install-time execution. Payload: index.js Key findings: - OAST/Interactsh Exfiltration in index.js: ".oast.fun" - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Install Hook Executes Local JS File in package.json: ""preinstall": "node index.js"" IOCs: - urls: http://169.254.169.254/latest/meta-data/iam/info - domains: d756g1ti191heqk6b9l0o5r1sjctxedm9.oast.fun, data.context.cloud - payloadFileHash: 81eb1aab011034cdb67ab900e98f862569a9b75c37bb0e8e16da8ee23b88083e