GCVE-110-OSM-2026-3192

Executes a remote JavaScript infostealer payload fetched from attacker-controlled infrastructure (oob.moika.tech) at npm install time via a preinstall hook. The hook constructs a per-package URL and eval()s the response, granting arbitrary code execution in the victim build environment. Part of a 6-package dependency confusion campaign targeting @apple-pay-trust, @tw-models, @tw-utils, and kl-b2c-ui-kit internal namespace patterns. Publisher: boris.wh1te@yandex.ru. **Trigger** (`preinstall`): executes `node preinstall.js` at install time. **Fetch**: constructs URL `http://oob.moika.tech/${scope}.${pkg}/${rand}` and fetches it via unauthenticated HTTP GET. **Execution**: eval()s the HTTP response body verbatim, granting the C2 server arbitrary code execution in the victim build environment. **Confirmed payload**: 7,718-byte JavaScript infostealer served live from oob.moika.tech at time of analysis.