GCVE-110-OSM-2026-3122

Exfiltrates public IP address, username, hostname, OS platform, and environment variables to an attacker-controlled Discord webhook via preinstall and postinstall hooks. Uses dependency confusion with inflated version 99.9.9 to target Auth0/Okta internal developers. preinstall and postinstall hooks both execute `node index.js`, firing twice per install. index.js imports https, child_process.exec, and os (Node.js built-ins only). It runs a platform-branched shell command to collect the host public IP via a public IP lookup service, username, hostname, and the first 50 environment variables. It also calls os.userInfo().username, os.hostname(), and os.platform(). The collected data is JSON-serialized into a Discord embed with labeled fields and sent via HTTPS POST to https://discord.com/api/webhooks/1496899189077049415/R1AueSOLPRzAS0df9JJAAXKKalhFt213roHABsq0VnsleKP7Gx2BOch04G9xeh1Gfapa. No file reads, no persistence, no secondary payloads.