GCVE-110-OSM-2026-6011

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY callback.js (install-hook: node callback.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - discord-webhook: https://discord.com/api/webhooks/1516163806559076442/j-EsZnZ4l2wqzbeef39EDg8f6hr_UsyIKNH5Y9wm9RBBBOcep36EfeEHKn_HlM6e-EZ6 (primary, plaintext) in callback.js EXFIL - Webhook Data Exfiltration in callback.js: "discord.com/api/webhooks/1516163806559076442/j-EsZnZ4l2wqzbeef39EDg8f6hr_UsyIKNH..." - Network Request in callback.js: "https.request(" - System Information Collection in callback.js: "os.userInfo()" - DNS Lookup in callback.js: "dns.resolve(" ADDITIONAL FINDINGS - Shell Command Execution in callback.js: "require('child_process')" - AWS Credential Access in callback.js: "process.env.AWS_ACCESS_KEY_ID" - Brand New Package PAYLOAD FILES callback.js INDICATORS (IOCs) - payloadFileHash: bc2bb13a751b66a6c89e02b6307b41bfccc20ca2ac3fe526050ab61202a60101