GCVE-110-OSM-2026-48

Advisory PublishedCVSS 5.4/10

Vulnetix · Advisory published June 7, 2026

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. Entrypoint: preinstall.js (install-hook: node preinstall.js || true) Exfil: d8f498hai91idrq6d800yt6eptci8myz6.oast.fun (custom-c2, recovery: plaintext in preinstall.js) Payload: preinstall.js Key findings: - OAST/Interactsh Exfiltration in preinstall.js: ".oast.fun" - Install Hook Executes Local JS File in package.json: ""preinstall": "node preinstall.js || true"" - System Information Exfiltration in preinstall.js: "__dirname.replace(/[^a-zA-Z0-9/_-]/g, "").slice(0, 80); const subdomain = `${ta..." - Platform Detection with Data Collection in preinstall.js: "JSON.stringify({ tag, hostname: h, username: u, cwd, ts: new Date().toISOS" - Rapid Version Publishing IOCs: - urls: https://hackerone.com/aon - domains: hackerone.com, aon.com, d8f498hai91idrq6d800yt6eptci8myz6.oast.fun - emails: vulnerability@aon.com - webhookServices: https://webhook.site/d0a32cf1-5d6f-4d94-bcb0-2a60cb37b8d6 - payloadFileHash: d89bee9e19a0e0f13b6abde3e1a89cd3bb04d4a864551eb362f29b79f0051247

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

5.4/10

Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions	Platforms
unknown	@aonunited/angular	all (affected)	—
unknown	parsejson-pro	all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), * (affected), * (affected)	—
unknown	yelp-react-component-rating	all (affected)	—
unknown	@eric-orderbuddyinfo/react-noval	all (affected), all (affected), all (affected), all (affected), all (affected), * (affected)	—