GCVE-110-OSM-2026-5831

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, network activity, install-time execution. Entrypoint: postinstall.js (install-hook: node postinstall.js) Exfil: http://154.57.164.82:31250 (custom-c2, recovery: plaintext in postinstall.js) Payload: postinstall.js Key findings: - OAST/Interactsh Exfiltration in postinstall.js: "webhook.site" - Install Hook Executes Local JS File in package.json: ""postinstall": "node postinstall.js"" - Shell Command Execution in postinstall.js: "require("child_process")" - System Information Exfiltration in postinstall.js: "os.hostname(), uid: process.getuid(), cwd: process.cwd(), data }); const url..." - HTTP Data Exfiltration in postinstall.js: "os.hostname(), uid: process.getuid(), cwd: process.cwd(), data }); const url..." IOCs: - ipv4: 154.57.164.82 - urls: http://154.57.164.82:31250 - webhookServices: https://webhook.site/602a4c72-7033-4e28-92ea-dc66e59206e5 - payloadFileHash: fa373d5e20b15a88c9efaf83babc897efe57151977d5c839270e76dc4f9c5dc4