GCVE-110-OSM-2026-5820

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. Entrypoint: postinstall.js (install-hook: node postinstall.js) Exfil: http://98.86.244.177:8080 (custom-c2, recovery: plaintext in index.js) Payload: postinstall.js Secondary files: index.js Key findings: - Shell Command Execution in index.js: "require('child_process')" - System Information Exfiltration in index.js: "os.hostname(); function httpRequest(method, path, body) { return new Promise(..." - HTTP Data Exfiltration in index.js: "os.hostname(); function httpRequest" - Install Hook Executes Local JS File in package.json: ""postinstall": "node postinstall.js"" - Shell Command Execution in postinstall.js: "require('child_process')" IOCs: - ipv4: 98.86.244.177 - urls: http://98.86.244.177:8080 - payloadFileHash: 694fc20b8419b539bb16387122a586ef25d44373d2684a0f72cd435bd6332bee