GCVE-110-OSM-2026-4550

[osmalyze-auto] Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution. [osmalyze-auto] Entrypoint: callback.js (install-hook: node ./callback.js || true) Payload: callback.js Key findings: - OAST/Interactsh Exfiltration in callback.js: ".oast.pro" - Install Hook Executes Local JS File in package.json: ""preinstall": "node ./callback.js || true"" - Brand New Package - Very New NPM Publisher Account IOCs: - urls: https://example.invalid/skysz-bbp-uol-poc - domains: meupainelhost.uol.com.br, oast.pro, d86r3dv5vn81lvohffp0131g8kdx9mz3c.oast.pro - payloadFileHash: 9995eda9986246d14944e74196fde1f8c5ce9568721eb9cff63795ec59c456cd