GCVE-110-OSM-2026-5755

This is a dependency confusion / supply chain reconnaissance package. The postinstall.js script executes on install and immediately collects hostname, username, current working directory, and a filesystem tree, then POSTs the base64-encoded payload to the attacker-controlled OAST endpoint wybqtvzmfhssbvhokfgb61yfn41sqvc9c.oast.fun. A DNS fallback exfiltrates hostname and username as a hex-encoded subdomain query to the same host, bypassing egress HTTP blocks. The publisher 'egyptian2' has a publisherMaliciousRatio of 1.0 with a prior confirmed malicious package (@access-risk/browser-remedy-react), and this package was created and versioned within seconds. The attacker model is classic dependency confusion probing: harvest environment fingerprints from developer or CI machines at install time. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: wybqtvzmfhssbvhokfgb61yfn41sqvc9c.oast.fun (primary, plaintext) in postinstall.js EXFIL - OAST/Interactsh Exfiltration in postinstall.js: ".oast.fun" - System Information Exfiltration in postinstall.js: "os.hostname(), u: os.userInfo().username, p: cwd, tree: tree(cwd, 0) }; // HTTPS..." - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.userInfo()" - DNS Lookup in postinstall.js: "dns.lookup(" - Suspicious Domain in postinstall.js: "oast.fun" ADDITIONAL FINDINGS - Brand New Package - Publisher Has Other Malicious Packages - Rapid Version Publishing PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: 26a21da51540ea595013edc6a2263316ddac6721501329e2b7b9a0449b7fd7de