GCVE-110-OSM-2026-4548

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, install-time execution. [osmalyze-auto] Entrypoint: index.js (install-hook: node index.js) Payload: index.js Key findings: - System Information Exfiltration in index.js: "JSON.stringify({ package: pkg, hostname: hostname, ips: ips, cwd: proces..." - HTTP Data Exfiltration in index.js: "process.cwd(), files: files, pkgz: pkgz }); const req = http.request" - Platform Detection with Data Collection in index.js: "JSON.stringify({ package: pkg, hostname: hos" - Install Hook Executes Local JS File in package.json: ""preinstall": "node index.js"" - Very New NPM Publisher Account IOCs: - payloadFileHash: fb2d307449b9ca8833d511120ed20f1c542982b138207082d6fe3373a193cfaa