GCVE-110-OSM-2026-5822

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. Entrypoint: callback.js (install-hook: node callback.js) Exfil: https://discord.com/api/webhooks/1514602063399747595/gctNdleRphIWLFSrx8QE4OSIAsVUhTAuJwgER-iRGPKPyEDdTgMT7XESjmOQG6QHEea1 (discord-webhook, recovery: plaintext in callback.js) Payload: callback.js Key findings: - Webhook Data Exfiltration in callback.js: "discord.com/api/webhooks/1514602063399747595/gctNdleRphIWLFSrx8QE4OSIAsVUhTAuJwg..." - Shell Command Execution in callback.js: "require('child_process')" - AWS Credential Access in callback.js: "process.env.AWS_ACCESS_KEY_ID" - Install Hook Executes Local JS File in package.json: ""preinstall": "node callback.js"" IOCs: - discordWebhooks: https://discord.com/api/webhooks/1514602063399747595/gctNdleRphIWLFSrx8QE4OSIAsVUhTAuJwgER-iRGPKPyEDdTgMT7XESjmOQG6QHEea1 - payloadFileHash: 2c40fe0264025fbd140ad245dbc08de6241e75e431b61e3c930a5172c1e2c492