GCVE-110-OSM-2026-5210

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, obfuscated code. Entrypoint: 66o/index.js (main: index.js) Exfil: https://api.telegram.org/bot989543891:AAH7DMWagamQIi0ogmQy7_AuovMP_Ic6T7M/sendMessage?chat_id=${...}&text=${...} (reconstructed, recovery: reconstructed) Payload: 66o/index.js Secondary files: _index.js Key findings: - Webhook Data Exfiltration in 66o/index.js: "hooks.slack.com/services/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" - OAST/Interactsh Exfiltration in 66o/index.js: "api.imgbb.com" - Webhook Data Exfiltration in _index.js: "hooks.slack.com/services/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" - OAST/Interactsh Exfiltration in _index.js: "api.imgbb.com" - Data Encoding for Exfiltration in 66o/db.js: "encodeURIComponent(x.from" IOCs: - urls: https://res.cloudinary.com/il/image/upload/c_scale, https://res.cloudinary.com/il/, https://iiilll.firebaseio.com/.json?shallow=true, https://iiilll.firebaseio.com/.json, https://api.telegram.org/bot989543891:AAH7DMWagamQIi0ogmQy7_AuovMP_Ic6T7M/sendMessage?chat_id=${...}&text=${...} (+4 more) - domains: iiilll.firebaseio.com, p-o.surge.sh, api.cloudinary.com, res.cloudinary.com, www.mapquestapi.com (+3 more) - telegramBots: 989543891:AAH7DMWagamQIi0ogmQy7_AuovMP_Ic6T7M, 919200894:AAHuM5pYRFtxMj-EKKQ4VTo8ZROr4yARpLI, 1453699653:AAHDfkzpMIR1omFnz5ha1FtzYY4f47TDLSk, 898353069:AAGp5H7zHEdhjOjMF7oOQLU03DF3tYGFx0o, 1998266306:AAEiVerla7_-JjR2fNc539ahJsGZg2xlpwY - telegramApi: api.telegram.org/bot${TOKEN}/`, api.telegram.org/bot${T}/sendMessage?chat_id=${chat}&text=${encodeURIComponent(l)}`), api.telegram.org/bot${T}/sendMessage?chat_id=${chat}&text=${r.description}`), api.telegram.org/bot${TOKEN}/deleteMessage?chat_id=${re.chat}&message_id=${re.message_id}`), api.telegram.org/bot${T}/sendMessage?chat_id=${id}&text=${encodeURIComponent(z)}` (+3 more) - slackWebhooks: https://hooks.slack.com/services/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 - payloadFileHash: 7122b2311aab5521cc9f9b7cb5f36e32bb504322f998313575728de3e3ea61ad