GCVE-110-OSM-2026-5895

This is a textbook dependency-confusion attack with DNS-based exfiltration. The install hook executes index.js, which uses charCode-array obfuscation to hide its behavior: it collects os.userInfo().username, os.hostname(), and process.cwd() then fires a DNS lookup to 'twigextras.{username}.{hostname}.{cwd}.{timestamp}.oob.sl4x0.xyz' — an out-of-band DNS callback beacon registered at the attacker-controlled domain sl4x0.xyz. The version numbers 99.99.9 and 99.99.10 are a hallmark of dependency confusion, designed to outrank any internal 'twig.extras' package a victim organization might use. The publisher account (dattopoc@sl4x0.xyz) was created the same day the package was published, and the homepage points to 'https://github.com/sl4x0', corroborating the attacker identity. No legitimate build tool collects hostname/username/cwd and exfiltrates them via DNS on install. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json ADDITIONAL FINDINGS - Rapid Version Publishing INDICATORS (IOCs) - domains: sl4x0.xyz - emails: research@sl4x0.xyz