GCVE-110-OSM-2026-5902

This is a dependency confusion / supply chain probe that executes on install via a preinstall hook ('node index.js'). The entrypoint file explicitly collects hostname, home directory, username, DNS servers, working directory, and full package.json, then POSTs all of it in plaintext to a Pipedream OAST endpoint (eo1e4fhn1i67p8r.m.pipedream.net). The package description 'pOc gececi' and the author email 'testerbounty123456@gmail.com' suggest a bug bounty / dependency confusion test, but the publisher already has a confirmed malicious package (@qlab/ui) with a publisherMaliciousRatio of 1.0, making the 'bounty test' framing insufficient to downgrade severity. The code is fully readable and the attacker model — install-time system fingerprinting exfiltrated to an attacker-controlled collector — is unambiguous. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: eo1e4fhn1i67p8r.m.pipedream.net (primary, plaintext) in index.js EXFIL - OAST/Interactsh Exfiltration in index.js: "pipedream.net" - System Information Exfiltration in index.js: "dns.getServers(), r: packageJSON ? packageJSON.___resolved : undefined, v: packa..." - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in index.js: "JSON.stringify({ p: package, c: __dirname, hd: os.homedir(), hn: os.hostname(), ..." - Publisher Has Other Malicious Packages PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: a7e18272aee814e3f4f821b4b911ff6586a8ee7170087ebdb52d99f61d0e789a