GCVE-110-OSM-2026-5848

Suspected dependency confusion attack. Behaviors: data exfiltration, install-time execution. Exfil: http://10.107.121.85:8000/callback_wget (custom-c2, recovery: plaintext in package.json) Key findings: - Brand New Package - Very New NPM Publisher Account IOCs: - urls: http://10.107.121.85:8000/callback_wget, http://10.107.121.85:8000/callback_curl, http://10.107.121.85:8000/callback_py