GCVE-110-OSM-2026-5670

Suspected dependency confusion attack. Behaviors: data exfiltration, code execution, install-time execution. Entrypoint: test.js (install-hook: node test.js) Payload: index.js Key findings: - Environment Variable Exfiltration in index.js: "process.env["USER"] || "unknown"; const payload = Buffer.concat([Buffer.fro..." - Shell Command Execution in index.js: "require("child_process")" - Platform Detection with Data Collection in index.js: "JSON.stringify({ created, username, publicIp, platform: process.platform }) )..." - Install Hook Executes Local JS File in package.json: ""postinstall": "node test.js"" - Brand New Package IOCs: - payloadFileHash: 79aa5a78c3be61c42af94f1d4cff38f4752c458546d1033560f5f4008ef6b127