GCVE-110-OSM-2026-6163

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY install.js (install-hook: node install.js) - Install Hook Executes Local JS File in package.json EXFIL - System Information Exfiltration in install.js: "os.hostname(), user: os.userInfo().username, homedir: os.homedir(), platform: os..." - HTTP Data Exfiltration in install.js: "os.userInfo().username, homedir: os.homedir(), platform: os.platform(), cwd: pro..." - Network Request in install.js: "https.request(" - System Information Collection in install.js: "os.userInfo()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in install.js: "JSON.stringify({ package: 'datacamp-light', hostname: os.hostname(), user: os.us..." - Brand New Package PAYLOAD FILES install.js INDICATORS (IOCs) - payloadFileHash: 3c45f85bae5b016c2d076c42d30a861aff63ea96f27e565882ec790c1e3d5f12