GCVE-110-OSM-2026-3157

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, network activity, install-time execution. Payload: index.js Key findings: - OAST/Interactsh Exfiltration in index.js: ".oast.fun" - Shell Command Execution in index.js: "require('child_process')" - Data Encoding for Exfiltration in index.js: "encodeURIComponent(key)}=${encodeURIComponent(value" - Install Hook Executes Local JS File in package.json: ""postinstall": "node index.js"" - Brand New Package IOCs: - domains: iqflwqhtuluqyysnswdrmypjslf59ryi0.oast.fun - payloadFileHash: 53c2f8a9b395bb0a813bc7fe0f1a59dfcb3a08242956508b1e43cb7b1fa37e37