GCVE-110-OSM-2026-4808

Exfiltrates system reconnaissance data — hostname, username, platform, architecture, working directory, PID, and timestamp — to an attacker-controlled OAST callback domain (fxpkkxatijbbyxuhdclqig6334q9m1j8w.oast.fun) via HTTPS GET in a preinstall hook. Package description explicitly reads 'hijacking by yusif', self-declaring malicious intent. **Trigger** (`preinstall`): executes `node index.js` at install time. **Collection**: reads `os.hostname()`, `os.userInfo().username`, `os.platform()`, `os.arch()`, `process.cwd()`, `process.pid`, and `new Date().toISOString()`. **Exfiltration**: issues a single HTTPS GET request with all collected data encoded as URL query parameters to `https://fxpkkxatijbbyxuhdclqig6334q9m1j8w.oast.fun/`. No secondary payload, no persistence mechanism, no credential access.