GCVE-110-OSM-2026-5646

Malicious package detected. Behaviors: data exfiltration, install-time execution. Entrypoint: canary.js (install-hook: node canary.js postinstall) Exfil: 157.230.17.236 (custom-c2, recovery: plaintext in canary.js) Payload: canary.js Key findings: - System Information Exfiltration in canary.js: "os.hostname() || '').slice(0, 200), }); const request = http.request" - HTTP Data Exfiltration in canary.js: "os.hostname() || '').slice(0, 200), }); const request = http.request" - Install Hook Executes Local JS File in package.json: ""postinstall": "node canary.js postinstall"" - Rapid Version Publishing IOCs: - ipv4: 157.230.17.236 - payloadFileHash: 0383509dcbcb2b73adaf08369e849a006a06f130c703013f2b42b46a089fb5af