GCVE-110-OSM-2026-5908

This package is a classic supply-chain implant: the postinstall hook builds and immediately executes dist/index.js, which runs `uname -a` via child_process.exec and exfiltrates the result to a hardcoded attacker-controlled IP (35.222.62.189) as a query parameter. The code is completely unambiguous — the function `sendUnameToServer()` is called unconditionally at module load time, and the comment in Turkish ('uname -a komutunu çalıştır') confirms intentional authorship. The package pretends to be a UI accordion component but contains no accordion functionality whatsoever. The publisher email (aydinnyunus+5@gmail.com with a +N suffix) and the account being only ~214 days old with 27 packages published on the same day are consistent with a bulk-registration typosquatting campaign. ENTRY dist/index.js (install-hook: npm run build && node dist/index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://35.222.62.189/ (primary, plaintext) in dist/index.js - custom-c2: 35.222.62.189 (plaintext) in dist/index.js EXFIL - Network Request in dist/index.js: "http.get(" - Suspicious Domain in dist/index.js: "http://35.222.62.189" - Network Request in index.ts: "http.get(" - Suspicious Domain in index.ts: "http://35.222.62.189" ADDITIONAL FINDINGS - Shell Command Execution in dist/index.js: "require("child_process")" PAYLOAD FILES dist/index.js (+ index.ts) INDICATORS (IOCs) - urls: https://aka.ms/tsconfig - domains: aka.ms - payloadFileHash: 1fa2256b8395f3648ab1533296a56e21eeaced2f5468e7eea3656ecd12583f8e