GCVE-110-OSM-2026-6305

Suspected dependency confusion attack. Behaviors: data exfiltration, code execution, install-time execution. ENTRY test.js (install-hook: node test.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in index.js: "process.env["USER"] || "unknown"; const payload = Buffer.concat([Buffer.from(env..." - Network Request in index.js: "fetch("https:" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Platform Detection with Data Collection in index.js: "JSON.stringify({ created, username, publicIp, platform: process.platform }) ); /..." PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 40f9a81d39fc4fc5a1895aa2f82b01fab53b5eae8b61c80885affddb485db439