GCVE-110-OSM-2026-6495

The package's preinstall hook executes index.js which explicitly reads /etc/passwd and /etc/hosts, collects hostname, username, home directory, DNS servers, and full package.json, then POSTs all of this to a Burp Collaborator OAST endpoint (ltiyq4zyhrs88zgp5lef9hbec5i46uuj.oastify.com) on install. The attacker model is classic supply-chain reconnaissance: on any developer or CI machine that installs this package, system identity and credential-adjacent files are immediately exfiltrated. The code is unobfuscated and the comments even label the fields explicitly ('Username on the remote server', '/etc/passwd from the remote system'). The publisher is a newly created account (~99 days old) with minimal package history and no metadata, consistent with a throwaway exfiltration account. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: ltiyq4zyhrs88zgp5lef9hbec5i46uuj.oastify.com (primary, plaintext) in index.js EXFIL - Sensitive File Access in index.js: "'/etc/passwd'" - OAST/Interactsh Exfiltration in index.js: "oastify.com" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "oastify.com" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 2366c47882d392d747f54b6c960959feff25b001d7ba6722f0b003e04ea85738