GCVE-110-OSM-2026-3381

Malicious package detected. Behaviors: data exfiltration, install-time execution. Payload: postinstall.js Key findings: - Install Hook Executes Local JS File in package.json: ""postinstall": "node postinstall.js"" - System Information Exfiltration in postinstall.js: "os.hostname(), username: os.userInfo().username, cwd: process.cwd() }); const ..." - HTTP Data Exfiltration in postinstall.js: "os.hostname(), username: os.userInfo().username, cwd: process.cwd() }); const ..." - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({ hostname: os.hostname(), username: os" - Very New NPM Publisher Account IOCs: - domains: stockbit.com - emails: ahmad.dayanullah@stockbit.com - payloadFileHash: 2eeee3eb2236029009cd00e152fd96eebe73e34da16ccd935f5f74a735f05c15