GCVE-110-OSM-2026-3263

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, install-time execution. Key findings: - OAST/Interactsh Exfiltration in package.json: "webhook.site" - Shell Command Execution in package.json: "require('child_process')" - System Information Exfiltration in package.json: "os.hostname(), info:stdout, platform:os.platform()}); const req = https.request" - HTTP Data Exfiltration in package.json: "os.hostname(), info:stdout, platform:os.platform()}); const req = https.request" - Platform Detection with Data Collection in package.json: "JSON.stringify({msg:'DEEP_DIVE_SUCCESS', host:os.hostname(), info:stdout, platfo..." IOCs: - urls: https://webhook.site/c14a0e2c-eb0f-41ef-ae64-d2326b9fb8e7?log= - webhookServices: https://webhook.site/c14a0e2c-eb0f-41ef-ae64-d2326b9fb8e7?log=