GCVE-110-OSM-2026-5753

Despite the 'educational demonstration' framing, this package executes a fully functional exfiltration payload at install time: it reads the victim's `.env` file from `INIT_CWD`, collects `os.hostname()` and `os.platform()`, and POSTs the assembled JSON to a hardcoded, attacker-controlled ngrok tunnel (`scary-blooper-brewery.ngrok-free.dev/collect`). The 'DEMO_-prefix only' filter is a trivial social-engineering fig leaf — real educational packages do not phone home to live attacker infrastructure. The publisher account is less than a day old, published four versions of this package in under 30 minutes (rapid version spam), and has no prior reputation. The attacker model is classic supply-chain credential harvesting: publish a plausibly-named package, wait for victims to `npm install` in a directory containing a `.env` file, and receive the captured data via ngrok. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://scary-blooper-brewery.ngrok-free.dev (primary, plaintext) in postinstall.js - custom-c2: scary-blooper-brewery.ngrok-free.dev (plaintext) in postinstall.js EXFIL - System Information Collection in postinstall.js: "os.hostname()" ADDITIONAL FINDINGS - Ngrok Tunneling Service in postinstall.js: "ngrok-free.dev" - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES postinstall.js INDICATORS (IOCs) - urls: https://example-ngrok-url.ngrok-free.dev/collect - domains: example-ngrok-url.ngrok-free.dev - payloadFileHash: 9455404075feb7357f87cf37c9625eaacf901bde40b9c854fc7a1b60a4d58269