GCVE-110-OSM-2026-4770

Malicious package detected. Behaviors: data exfiltration, install-time execution. Entrypoint: index.js (install-hook: node index.js) Payload: index.js Key findings: - Sensitive File Access in index.js: "'.aws/credentials'" - OAST/Interactsh Exfiltration in index.js: "webhook.site" - System Information Exfiltration in index.js: "os.homedir(), '.config/gcloud/application_default_credentials.json'), 'utf8').su..." - Install Hook Executes Local JS File in package.json: ""postinstall": "node index.js"" - Publisher Has Other Malicious Packages IOCs: - payloadFileHash: d256417643934dd2d12964a156fd7b122321ccd9238cdcad2fbf55baf46f0a1e