GCVE-110-OSM-2026-5645

Malicious package detected. Behaviors: data exfiltration, install-time execution. Entrypoint: canary.js (install-hook: node canary.js postinstall) Exfil: 157.230.17.236 (custom-c2, recovery: plaintext in canary.js) Payload: canary.js Key findings: - System Information Exfiltration in canary.js: "os.hostname() || '').slice(0, 200), }); const request = http.request" - HTTP Data Exfiltration in canary.js: "os.hostname() || '').slice(0, 200), }); const request = http.request" - Install Hook Executes Local JS File in package.json: ""postinstall": "node canary.js postinstall"" - Rapid Version Publishing IOCs: - ipv4: 157.230.17.236 - payloadFileHash: bb59b79bfe2d4ebec8e04caec6ef085e6b7cef508c7bf26e5e90a4e20eba4a21