GCVE-110-OSM-2026-5829

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, network activity, install-time execution. Entrypoint: postinstall.js (install-hook: node postinstall.js) Exfil: http://154.57.164.82:31250 (custom-c2, recovery: plaintext in postinstall.js) Payload: postinstall.js Key findings: - OAST/Interactsh Exfiltration in postinstall.js: "webhook.site" - Install Hook Executes Local JS File in package.json: ""postinstall": "node postinstall.js"" - Shell Command Execution in postinstall.js: "require("child_process")" - System Information Exfiltration in postinstall.js: "os.hostname(), uid: process.getuid(), cwd: process.cwd(), data..." - HTTP Data Exfiltration in postinstall.js: "process.cwd(), data: String(data).slice(0, 120000) }); const url =..." IOCs: - ipv4: 154.57.164.82, 154.57.164.71 - urls: http://154.57.164.82:31250, http://154.57.164.71:31289 - webhookServices: https://webhook.site/602a4c72-7033-4e28-92ea-dc66e59206e5 - payloadFileHash: e7e1df281523ffd29884cbce16ade46bce76e90731d8ce252d90452e4b1567cf