GCVE-110-OSM-2026-4879

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration. Exfil: https://www.pendo.io/?builder.frameEditing=true (custom-c2, recovery: plaintext in poc.js) Payload: poc.js Key findings: - OAST/Interactsh Exfiltration in poc.js: "webhook.site" - Data Encoding for Exfiltration in poc.js: "encodeURIComponent(d)})\";w.document.head.appendChild(s" - Platform Detection with Data Collection in poc.js: "JSON.stringify({email:'1337+triage@intigriti.me',role:2,first:'Security',last:'R..." - Brand New Package - Very New NPM Publisher Account IOCs: - urls: https://www.pendo.io/?builder.frameEditing=true, https://novus-api.pendo.io/pendo/user - domains: www.pendo.io, novus-api.pendo.io, intigriti.me - emails: 1337+triage@intigriti.me - bitcoinAddresses: 3f368183bc314ba396dbaf34967e8e67 - webhookServices: https://webhook.site/#!/view/236d0505-1750-49fe-907d-604b0934b5c7/c65d9ee2-3113-464a-8318-532e391a494c/1?action=invite&status= - payloadFileHash: cbda351085c9f6918ba709c6ab210c83ed4981de2f81dd8aa98b528c3bf165ff