GCVE-110-OSM-2026-5967

This is a textbook dependency-confusion attack. The package uses version 9.9.9 (all-nines inflation) to outrank any internal 'flowdefi' package, and its preinstall hook immediately executes index.js on install. The entrypoint code is fully readable and unambiguous: it collects hostname, username, current working directory, and a filtered set of environment variables matching crypto/credential keywords (key, seed, secret, token, private, mnemonic, password, blockfrost, redis, telegram, batcher), then POSTs the payload in plaintext JSON to the attacker-controlled C2 at 2.25.140.71:8443/surflending/npm-confusion. The path '/surflending/npm-confusion' explicitly names the attack vector. There is no legitimate explanation for this behavior. ENTRY index.js (install-hook: node index.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: 2.25.140.71 (primary, plaintext) in index.js EXFIL - Environment Variable Exfiltration in index.js: "process.env[k]; return a; }, {}), c: process.cwd(), t: Date.now() }); const req ..." - System Information Exfiltration in index.js: "os.userInfo().username, e: Object.keys(process.env).filter(k => /key|seed|secret..." - HTTP Data Exfiltration in index.js: "process.cwd(), t: Date.now() }); const req = https.request" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in index.js: "JSON.stringify({ h: os.hostname(), u: os" PAYLOAD FILES index.js INDICATORS (IOCs) - ip: 2.25.140.71 - payloadFileHash: 8936519f32d19d50089d55b700528b0a3149a27b8df271f19547c396948a8bdc