GCVE-110-OSM-2026-6009

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, install-time execution. ENTRY run.js (install-hook: node run.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - custom-c2: diameter-coins-limitations-parents.trycloudflare.com (primary, plaintext) in beacon25.js - custom-c2: payload.net (plaintext) in beacon_linux.js - custom-c2: 34.196.43.233 (plaintext) in beacon_linux.js - custom-c2: 173.255.233.239 (plaintext) in beacon_linux.js EXFIL - OAST/Interactsh Exfiltration in beacon25.js: ".trycloudflare.com" - Data Encoding for Exfiltration in beacon25.js: "encodeURIComponent(String(w).slice(0, 1200" - Data Encoding for Exfiltration in beacon_linux.js: "encodeURIComponent(MARKER + '|' + PHASE" - Network Request in beacon25.js: "https.request(" - System Information Collection in beacon25.js: "process.platform" - Network Request in beacon_linux.js: "http.request(" - System Information Collection in beacon_linux.js: "os.userInfo()" - System Information Collection in run.js: "process.platform" ADDITIONAL FINDINGS - Shell Command Execution in beacon25.js: "require('child_process')" - Silent Process Execution in beacon25.js: "windowsHide: true" - Brand New Package - Rapid Version Publishing PAYLOAD FILES beacon25.js (+ beacon_linux.js) INDICATORS (IOCs) - domains: curran.tech - emails: nicholas@curran.tech - payloadFileHash: 69515d1771dc9ab96f44b52e89b4464beaef980a3644d94084438d387e2b8454