GCVE-110-OSM-2026-6539

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, network activity, install-time execution. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://2e3bkumw.requestrepo.com (primary, plaintext) in postinstall.js - custom-c2: http://9.128.133.118:9000/ (plaintext) in postinstall.js - custom-c2: 2e3bkumw.requestrepo.com (plaintext) in postinstall.js - custom-c2: 9.128.133.118 (plaintext) in postinstall.js EXFIL - OAST/Interactsh Exfiltration in postinstall.js: "requestrepo.com" - Suspicious Domain in postinstall.js: "http://9.128.133.118" ADDITIONAL FINDINGS - Download Execute Delete Pattern in postinstall.js: "writeFileSync(tf, JSON.stringify({key,data:typeof data==='string'?data.slice(0,1..." - Shell Command Execution in postinstall.js: "require('child_process')" - Silent Process Execution in postinstall.js: "stdio:'ignore'" - Brand New Package - Rapid Version Publishing PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: 5a9fd565ce541644e00c308fb89352de7ae985bdd80ea0ba96a3cb09ac738c9c