GCVE-110-OSM-2026-6594

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json EXFIL - OAST/Interactsh Exfiltration in postinstall.js: "webhook.site" - Environment Variable Exfiltration in preinstall.js: "process.env.USER || process.env.USERNAME || 'unknown'), env_keys: Object.keys(pr..." - OAST/Interactsh Exfiltration in preinstall.js: "webhook.site" - System Information Exfiltration in postinstall.js: "JSON.stringify({ pkg: 'hs-locale-management', version: '99.99.99-poc2', hook: 'p..." - HTTP Data Exfiltration in postinstall.js: "process.cwd(), pid: process.pid, node: process.version, platform: process.platfo..." - Network Request in postinstall.js: "http.request(" - System Information Collection in postinstall.js: "process.platform" - Network Request in preinstall.js: "http.request(" (+2 more) ADDITIONAL FINDINGS - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({ pkg: 'hs-locale-management', version: '99.99.99-poc2', hook: 'p..." PAYLOAD FILES postinstall.js (+ preinstall.js) INDICATORS (IOCs) - payloadFileHash: 5bc47ee3954ae8a41c667c663a7ab4c66c0d1e23b44c222c1356f04a81bcbd0c