GCVE-110-OSM-2026-4694

Exfiltrates system reconnaissance data — username, hostname, platform, working directory, and CI environment variables (CI, GITHUB_REPOSITORY, NODE_ENV) — to an attacker-controlled OAST endpoint (6v2j7oyzq0ehzolr4303sw1vwm2gqje8.oastify.com) via HTTPS GET and a secondary DNS beacon that encodes the username as a subdomain, both triggered silently at install time via a postinstall hook. The package impersonates Microsoft Power Platform and Playwright; the /microsft path in the C2 URL is a deliberate Microsoft typo consistent with dependency-confusion campaigns. **Trigger** (`postinstall`): executes `node postinstall.js` at install time. **Collection**: runs `execSync('whoami')` to capture the current username; reads `os.hostname()`, `process.platform`, `process.cwd()`, `process.env.CI`, `process.env.GITHUB_REPOSITORY`, and `process.env.NODE_ENV`. **Exfiltration (HTTP)**: issues an HTTPS GET request to `https://6v2j7oyzq0ehzolr4303sw1vwm2gqje8.oastify.com/microsft` with all collected fields as query parameters. **Exfiltration (DNS)**: calls `dns.lookup()` on a subdomain constructed as `<username>.6v2j7oyzq0ehzolr4303sw1vwm2gqje8.oastify.com`, encoding the username in the DNS query itself.