GCVE-110-OSM-2026-6152

Malicious package detected. Behaviors: data exfiltration, network activity, install-time execution. ENTRY beacon.js (install-hook: node beacon.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - custom-c2: http://169.254.169.254/metadata/instance?api-version=2021-02-01 (primary, plaintext) in beacon.js - custom-c2: http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/ (plaintext) in beacon.js - custom-c2: http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net (plaintext) in beacon.js - custom-c2: http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://graph.microsoft.com (plaintext) in beacon.js - custom-c2: http://169.254.169.254/latest/meta-data/ (plaintext) in beacon.js - custom-c2: http://metadata.google.internal/computeMetadata/v1/ (plaintext) in beacon.js - custom-c2: http://100.100.100.200/latest/meta-data/ (plaintext) in beacon.js - custom-c2: fp.net (plaintext) in beacon.js (+2 more) EXFIL - Data Encoding for Exfiltration in beacon.js: "encodeURIComponent(MARKER + '|' + PHASE" - Network Request in beacon.js: "http.request(" - System Information Collection in beacon.js: "os.userInfo()" - Suspicious Domain in beacon.js: "http://100.100.100.200" PAYLOAD FILES beacon.js INDICATORS (IOCs) - domains: curran.tech - emails: nicholas@curran.tech - payloadFileHash: e2bda0a7a4803ef559a26f522ae39add4862af94989e57a7300e0552c65a2f4d