GCVE-110-OSM-2026-6014

Exfiltrates system fingerprint data (username, working directory, OS platform, CPU architecture, Node.js version) to an attacker-controlled OAST endpoint at install time via a preinstall hook. Published by npm user corryxsd (corrycotton100@gmail.com) under author name 'poc', with three versions (1.999.0, 2.999.0, 2.999.1) pushed within 14 minutes on 2026-06-16 using 999.x.x versioning to preempt private registry pinning. The preinstall hook runs node index.js unconditionally and POSTs the collected data to https://avamnrwqo7.rbmock.dev/ (attacker-controlled rbmock.dev request-bin/OAST service). No second stage or persistence mechanism was identified. Trigger: preinstall hook executes node index.js > /dev/null 2>&1 at npm install time. The hook script index.js runs at module top level with no conditional gates. It collects: os.userInfo().username (system username), process.cwd() (working directory at install time), process.platform, process.arch, process.version, a new Date().toISOString() timestamp, and crypto.randomUUID() as an install tracking ID. All fields are serialized as JSON and sent via https.request() POST to https://avamnrwqo7.rbmock.dev/ — an attacker-controlled rbmock.dev request-bin/OAST subdomain unique to this actor. Output is suppressed via > /dev/null 2>&1. lodash@^4.17.21 is declared in dependencies but never imported (phantom dependency). Stage chain not resolved — second-stage capabilities unknown.