GCVE-110-OSM-2026-5727

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. Entrypoint: postinstall.js (install-hook: node postinstall.js) Exfil: http://h4mx6b7krgzarfehbutwabxbu20tojc8.oastify.com/metadata (oast, recovery: plaintext in postinstall.js) Payload: postinstall.js Key findings: - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Install Hook Executes Local JS File in package.json: ""postinstall": "node postinstall.js"" - Very New NPM Publisher Account IOCs: - urls: http://cip.cc, https://mtsrc-test.sankuai.com/ssrf, http://169.254.169.254/latest/meta-data/iam/security-credentials/sandyclaw-canary-worker-role, http://metadata.tencentyun.com/latest/meta-data/, http://169.254.0.23/latest/meta-data/ - oastEndpoints: http://h4mx6b7krgzarfehbutwabxbu20tojc8.oastify.com/metadata, http://h4mx6b7krgzarfehbutwabxbu20tojc8.oastify.com/data - payloadFileHash: 04b298c683b179c7793f27c8736177da01c278dbc8c4d6dc62ae375cc285f27b