GCVE-110-OSM-2026-6592

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json EXFIL - OAST/Interactsh Exfiltration in postinstall.js: "webhook.site" - Environment Variable Exfiltration in preinstall.js: "process.env.USER || process.env.USERNAME || 'unknown'), env_keys: Object.keys(pr..." - OAST/Interactsh Exfiltration in preinstall.js: "webhook.site" - System Information Exfiltration in postinstall.js: "JSON.stringify({ pkg: 'signup-embedder', version: '99.99.99-poc2', hook: 'postin..." - HTTP Data Exfiltration in postinstall.js: "process.cwd(), pid: process.pid, node: process.version, platform: process.platfo..." - Network Request in postinstall.js: "http.request(" - System Information Collection in postinstall.js: "process.platform" - Network Request in preinstall.js: "http.request(" (+1 more) ADDITIONAL FINDINGS - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({ pkg: 'signup-embedder', version: '99.99.99-poc2', hook: 'postin..." PAYLOAD FILES postinstall.js (+ preinstall.js) INDICATORS (IOCs) - payloadFileHash: 9fa18174543325644f9a5fb47c15e7fb826a46ff45f70120ce8416cc9c095135