GCVE-110-OSM-2026-5628

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. Entrypoint: postinstall.js (install-hook: node postinstall.js) Payload: postinstall.js Key findings: - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Install Hook Executes Local JS File in package.json: ""postinstall":"node postinstall.js"" - System Information Exfiltration in postinstall.js: "os.homedir(), cwd: process.cwd(), argv: process.argv, pid: process.pid, ..." IOCs: - payloadFileHash: 1ded8a789cf3732b19e4d08f9f8b224a4c81914daad56d165ca4fbce8cf21e07