GCVE-110-OSM-2026-5969

The package self-identifies as a 'Bug Bounty PoC' ('Zararsiz Bug Bounty PoC testidir. No malicious code inside.') authored by 'Ethical Researcher', which matches the dependency-confusion/bug-bounty test pattern. The preinstall script in package.json does perform real exfiltration — it collects `os.hostname()` and beacons it to a webhook.site endpoint — but the self-identification and the use of webhook.site (rather than an attacker-controlled C2) are consistent with a researcher demonstrating a vulnerability rather than a genuine supply-chain attack. This is a borderline case: the code is functionally malicious but the declared intent is a security test, so it should be flagged but not submitted to OSM as a true malware finding, to avoid polluting the database with bounty tests. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "node -e \"" DESTINATION - custom-c2: https://https://webhook.site/cbfd239f-50d1-4bc6-9801-ba08ba9a2a4a/?host=numdiff- (primary, plaintext) in package.json - webhookServices: https://webhook.site/cbfd239f-50d1-4bc6-9801-ba08ba9a2a4a/?host=numdiff- (exfil, plaintext) EXFIL - OAST/Interactsh Exfiltration in package.json: "webhook.site" - System Information Collection in package.json: "os.hostname()"