GCVE-110-OSM-2026-2716

Malicious package detected. Behaviors: data exfiltration, install-time execution. Payload: postinstall.js Key findings: - Install Hook Executes Local JS File in package.json: ""postinstall": "node postinstall.js"" - System Information Exfiltration in postinstall.js: "os.userInfo().username, cwd: process.cwd(), env: process.env }); const opti..." - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({ hostname: os.hostname(), username: os" - Brand New Package IOCs: - domains: attacker.appsec.cc - payloadFileHash: 67b38f0c558ee3252b546ec37c40eab872a6889f6a9f772fa6fc6127aba7e14e