GCVE-110-OSM-2026-5779

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. Entrypoint: postinstall.js (install-hook: node postinstall.js) Exfil: http://154.57.164.80:30543 (custom-c2, recovery: plaintext in postinstall.js) Payload: postinstall.js Key findings: - Install Hook Executes Local JS File in package.json: ""postinstall": "node postinstall.js"" - Shell Command Execution in postinstall.js: "require("child_process")" - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing IOCs: - ipv4: 154.57.164.80 - urls: http://154.57.164.80:30543, http://proxy.nexus.local:8081/service/rest/v1/status - payloadFileHash: ff84e4dee37e582fff205ff67a4e5bdd4c4de3c71b3ad8b48340fcc6ae4683fc