GCVE-110-OSM-2026-5914

The package executes a postinstall hook that runs `node dist/index.js`, which explicitly calls `uname -a` via `child_process.exec` and exfiltrates the system information to a hardcoded attacker-controlled IP `http://35.222.62.189/` as a query parameter (`?name=<uname output>`). The function `sendUnameToServer()` is called unconditionally at module load time, confirming this executes on every install. The attacker model is reconnaissance/victim fingerprinting: collecting system details from every developer or CI system that installs this package. The package is a typosquat or namespace-abuse targeting users of the `@tx-components` ecosystem, published with a burner email (`aydinnyunus+5@gmail.com`) with no description, no repository, and only a single version. ENTRY dist/index.js (install-hook: npm run build && node dist/index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://35.222.62.189/ (primary, plaintext) in dist/index.js - custom-c2: 35.222.62.189 (plaintext) in dist/index.js EXFIL - Network Request in dist/index.js: "http.get(" - Suspicious Domain in dist/index.js: "http://35.222.62.189" - Network Request in index.ts: "http.get(" - Suspicious Domain in index.ts: "http://35.222.62.189" ADDITIONAL FINDINGS - Shell Command Execution in dist/index.js: "require("child_process")" PAYLOAD FILES dist/index.js (+ index.ts) INDICATORS (IOCs) - urls: https://aka.ms/tsconfig - domains: aka.ms - payloadFileHash: 1fa2256b8395f3648ab1533296a56e21eeaced2f5468e7eea3656ecd12583f8e