GCVE-110-OSM-2026-4809

Exfiltrates system identity and CI environment variables to attacker-controlled Burp Collaborator infrastructure (svr57aylqme3zald4p0psi1hw827q1eq.oastify.com) silently at install time. The postinstall script executes whoami and id via execSync, collects hostname, platform, cwd, and CI env vars (CI, GITHUB_REPOSITORY, NODE_ENV), and sends them via HTTP GET. A secondary DNS exfiltration path beacons the current username as a subdomain lookup against the same attacker-controlled host. The package description claiming 'security research canary — shopify' is a deniability tactic; the publisher (lobo_hunt / practiceextraone@gmail.com) is the same account behind OSM-confirmed malicious package testing-on-npmjs. **Trigger** (`postinstall`): `node postinstall.js` runs automatically on `npm install`. **Collection**: `execSync('whoami')` and `execSync('id')` capture shell identity; `os.hostname()`, `process.platform`, `process.cwd()` collected; `process.env.CI`, `process.env.GITHUB_REPOSITORY`, `process.env.NODE_ENV` harvested. **Exfiltration**: HTTP GET to `https://svr57aylqme3zald4p0psi1hw827q1eq.oastify.com/shopify` with URL-encoded payload. **DNS exfil**: DNS lookup of `<whoami>.<CALLBACK_HOST>` beacons the username as a subdomain query to the same oastify.com host.