GCVE-110-OSM-2026-5660

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. Entrypoint: callback.js (install-hook: node ./callback.js) Exfil: https://3y294ed4dfq501wnmdvbakcnwe25qvek.oastify.com (oast, recovery: plaintext in callback.js) Payload: callback.js Key findings: - OAST/Interactsh Exfiltration in callback.js: "oastify.com" - Data Encoding for Exfiltration in callback.js: "encodeURIComponent(TOK) + '/' + encodeURIComponent(host)); const lib = u.protoco..." - Install Hook Executes Local JS File in package.json: ""postinstall": "node ./callback.js"" IOCs: - oastEndpoints: https://3y294ed4dfq501wnmdvbakcnwe25qvek.oastify.com - payloadFileHash: a1796ad3ed640844791551a0cfc9aabe691ec7ffe3431212c70e3c061254260b