GCVE-110-OSM-2026-4623

[osmalyze-auto] Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, install-time execution. [osmalyze-auto] Entrypoint: install.js (install-hook: node install.js) Payload: install.js Key findings: - Shell Command Execution in install.js: "require('child_process')" - Silent Process Execution in install.js: "stdio: 'ignore'" - Install Hook Executes Local JS File in package.json: ""postinstall": "node install.js"" - Brand New Package - Rapid Version Publishing IOCs: - domains: mjcfux88wjjahplabxdauc6bl.canarytokens.com - payloadFileHash: 0dfc08ec02993dc0ee798da772eac18d639737cf653a1873bc5882d7ce60db13