GCVE-110-OSM-2026-6577

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. DESTINATION - oast: http://xxxxxxxxx.oastify.com (primary, plaintext) in postinstall.js - oast: http://i0jvc03bvcjt40q39f5fx8671y72vxjm.oastify.com (plaintext) in postinstall.js - custom-c2: http://ip-api.com/json/?fields=query (plaintext) in postinstall.js - custom-c2: ip-api.com (plaintext) in postinstall.js - custom-c2: geo.org (plaintext) in postinstall.js EXFIL - Environment Variable Exfiltration in postinstall.js: "process.env.npm_package_name || 'npm-takeover', 'X-PoC-Version': process.env.npm..." - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Network Request in postinstall.js: "http.get(" - System Information Collection in postinstall.js: "os.userInfo()" - Suspicious Domain in postinstall.js: "oastify.com" ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: a79a742307230c688f29fd9844cf9f41ff84d0eebf1571c18a818802fd16c38c