GCVE-110-OSM-2026-4284

[osmalyze-auto] Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, network activity, install-time execution. [osmalyze-auto] Entrypoint: index.js (install-hook: node index.js) Payload: index.js Key findings: - OAST/Interactsh Exfiltration in index.js: "oastify.com" - Shell Command Execution in index.js: "require('child_process')" - Data Encoding for Exfiltration in index.js: "encodeURIComponent(key)}=${encodeURIComponent(value" - Install Hook Executes Local JS File in package.json: ""postinstall": "node index.js"" - Publisher Has Other Malicious Packages IOCs: - payloadFileHash: 36f76ddcc88aed998e07955f2d18daeb1b723dcd68e8185d42bbde7c4b90a2d7