GCVE-110-OSM-2026-4851

The postinstall script is a fully functional dependency-confusion attack payload. The publisher has a 44.8% malicious-package ratio with 13 prior confirmed-critical packages, all consistent with the same campaign. Entrypoint: scripts/postinstall.js (install-hook: node scripts/postinstall.js) Exfil: https://oob.moika.tech/report (custom-c2, recovery: plaintext in scripts/postinstall.js) Payload: scripts/postinstall.js Key findings: On install it fetches a remote JS payload from `https://oob.moika.tech/payload/{os}.js`, writes it to a temp file (`._polka-ui_init.js`), and spawns it as a detached, stdio-suppressed process that outlives npm — a classic loader pattern. If the remote payload fetch fails, it falls back to POSTing the full `process.env`, hostname, username, platform, cwd, and node version to `https://oob.moika.tech/report`. A hardcoded comment in Cyrillic explicitly states the 3-second delay is to evade sandboxes (`// Задержка — обходит sandbox`). The variable names (`DEP_CONFUSION_URL`, `DEP_CONFUSION_PAYLOAD`, `poc: 'dependency-confusion-npm'`) confirm adversarial intent. IOCs: - urls: https://docs.polka-ui.io/platform/reco, https://jira.polka-ui.io/projects/PLATFORM, https://npm.polka-ui.io, https://github.polka-ui.io/platform/reco.git, https://oob.moika.tech/report (+1 more) - domains: oob.moika.tech - c2: https://oob.moika.tech/report - emails: platform@polka-ui.io - payloadFileHash: f49fdc20a597dff4563b1b00360ee68890d433cd2c27c011e0bbbdc5ccd1c1ae