GCVE-110-OSM-2026-6572

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. ENTRY bin/cli.js (install-hook: node bin/cli.js) - Install Hook Executes Local JS File in package.json EXFIL - Git Configuration Access in lib/user.js: "git config --global user.name" - System Information Collection in lib/claude-code.js: "os.homedir()" - System Information Collection in lib/codex.js: "os.homedir()" - System Information Collection in lib/cursor.js: "os.homedir()" - Suspicious Domain in lib/upload.js: "https://jrnptnvcpkympgxqhjnu.supabase" - System Information Collection in lib/user.js: "os.userInfo()" ADDITIONAL FINDINGS - Shell Command Execution in lib/user.js: "require('child_process')" - Very New NPM Publisher Account PAYLOAD FILES lib/user.js INDICATORS (IOCs) - payloadFileHash: c590e2543f241280656e3707ec0a7e112db818502a9503d254a6fc87474113ea