GCVE-110-OSM-2026-6661

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: ddactic-lab.online (primary, plaintext) in postinstall.js EXFIL - System Information Exfiltration in postinstall.js: "JSON.stringify({ p: pkg, v: ver, n: process.version, os: process.platform, ci: c..." - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "process.platform" - DNS Lookup in postinstall.js: "dns.lookup(" ADDITIONAL FINDINGS - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({ p: pkg, v: ver, n: process.version, os: process.platform" - Brand New Package - Very New NPM Publisher Account - Publisher Has Other Malicious Packages PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: e5c7efaa25bd6fc20c40fe6e39a40957043022e78b5ec6d9ad2b9e49a3ef75c8