GCVE-110-OSM-2026-3505

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. [osmalyze-auto] Entrypoint: preinstall.js (install-hook: node preinstall.js || true) Exfil: 8590047109:AAG4zumTH5TRzZE695d6mtYprtxB7AIb9so (telegram-bot, recovery: plaintext in postinstall.js) Payload: postinstall.js Secondary files: preinstall.js Key findings: - Install Hook Executes Local JS File in package.json: ""preinstall": "node preinstall.js || true"" - Shell Command Execution in postinstall.js: "require('child_process')" - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({chat_id: CHAT, text: msg.substring(0,4000)}); try { const ..." - Shell Command Execution in preinstall.js: "require('child_process')" - Platform Detection with Data Collection in preinstall.js: "JSON.stringify({chat_id: CHAT, text: msg.substring(0,4000)}); try { const ..." IOCs: - urls: http://169.254.169.254/latest/meta-data/iam/security-credentials/ - telegramBots: 8590047109:AAG4zumTH5TRzZE695d6mtYprtxB7AIb9so - payloadFileHash: 3f089cfb9c8b479a5f23b44728cdb4513efdc47cd5fcde6dc2b760f44c391563