GCVE-110-OSM-2026-5724

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. Exfil: https://d8l0dj5t5p5il86s3d3gepriqucsnn1nd.oast.me/?h= (oast, recovery: plaintext in package.json) Key findings: - OAST/Interactsh Exfiltration in package.json: ".oast.me" - Data Encoding for Exfiltration in package.json: "encodeURIComponent(h)+'&u='+encodeURIComponent(u)+'&pkg=mermaid-v11').on('error'..." - Brand New Package - Very New NPM Publisher Account - Publisher Has Other Malicious Packages IOCs: - urls: https://d8l0dj5t5p5il86s3d3gepriqucsnn1nd.oast.me/?h= - domains: d8l0dj5t5p5il86s3d3gepriqucsnn1nd.oast.me - oastEndpoints: https://d8l0dj5t5p5il86s3d3gepriqucsnn1nd.oast.me/?h=