GCVE-110-OSM-2026-5963

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution. ENTRY poc.js (install-hook: node poc.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: d8ntv8plujrg25sttkvg31bowtxhm7ex7.oast.live (primary, plaintext) in poc.js EXFIL - OAST/Interactsh Exfiltration in poc.js: ".oast.live" - Network Request in poc.js: "https.get(" - System Information Collection in poc.js: "os.userInfo()" PAYLOAD FILES poc.js INDICATORS (IOCs) - payloadFileHash: 026c9331347569ea2c351a3cc07472b65150cca25cd0aefc32d4680563b7092c