GCVE-110-OSM-2026-5076

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution. Entrypoint: ai/index.js (install-hook: node index.js) Exfil: eo1e4fhn1i67p8r.m.pipedream.net (custom-c2, recovery: plaintext in ai/index.js) Payload: ai/index.js Secondary files: index.js Key findings: - OAST/Interactsh Exfiltration in ai/index.js: "pipedream.net" - OAST/Interactsh Exfiltration in index.js: "pipedream.net" - System Information Exfiltration in ai/index.js: "dns.getServers(), r: packageJSON ? packageJSON.___resolved : undefined, ..." - Platform Detection with Data Collection in ai/index.js: "JSON.stringify({ p: package, c: __dirname, hd: os.homedir(), hn:..." - System Information Exfiltration in index.js: "dns.getServers(), r: packageJSON ? packageJSON.___resolved : undefined, ..." IOCs: - domains: eo1e4fhn1i67p8r.m.pipedream.net - payloadFileHash: 9e2d1a7590d6c1b987443fcabb878cf37f77ba485fb88c325bd89f0a614ad727