GCVE-110-OSM-2026-5844

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, obfuscated code, install-time execution. Entrypoint: index.js (install-hook: node index.js) Exfil: https://recorder-our-betting-chair.trycloudflare.com/page (tunnel, recovery: deobfuscated in index.js) Payload: index.js Key findings: - OAST/Interactsh Exfiltration in index.js: ".trycloudflare.com" - IOCs Found in Deobfuscated Code in index.js - System Information Exfiltration in index.js: "__dirname,exeFileName);function _0x1de1(_0xbeb05f,_0x2401cb){_0xbeb05f=_0xbeb05f..." - Obfuscation: augmented proxied array function replacements in index.js - Obfuscation Pattern: hexVariables in index.js: "_0x2e76da" IOCs: - urls: https://recorder-our-betting-chair.trycloudflare.com/page - tunnelServices: https://recorder-our-betting-chair.trycloudflare.com/page - domains: recorder-our-betting-chair.trycloudflare.com - _domainCandidates: recorder-our-betting-chair.trycloudflare.com - payloadFileHash: 4de80153e8bdba06a16c5a348c606aa3edc55b7fee954de9f1b063807dd00bb7