GCVE-110-OSM-2026-4547

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, install-time execution. [osmalyze-auto] Entrypoint: index.js (install-hook: node index.js) Payload: index.js Key findings: - System Information Exfiltration in index.js: "JSON.stringify({ package: pkg, hostname: hostname, ips: ips, cwd: proces..." - HTTP Data Exfiltration in index.js: "process.cwd(), files: files, pkgz: pkgz }); const req = http.request" - Platform Detection with Data Collection in index.js: "JSON.stringify({ package: pkg, hostname: hos" - Install Hook Executes Local JS File in package.json: ""preinstall": "node index.js"" - Brand New Package IOCs: - payloadFileHash: b91acafb04ff30af3898cd88940c2522cf2aae68fa28fde478d58ca20f425ce1