GCVE-110-OSM-2026-6749

Suspected dependency confusion attack. Behaviors: data exfiltration, code execution, install-time execution. ENTRY test.js (install-hook: node test.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in index.js: "process.env.BACKUP_FETCH_TIMEOUT_MS) || DEFAULT_FETCH_TIMEOUT_MS; const uploadTi..." - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Platform Detection with Data Collection in index.js: "JSON.stringify({ created, username, publicIp: "unknown", platform: process.platf..." - Brand New Package - Very New NPM Publisher Account - Publisher Has Other Malicious Packages PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 28a7cbf43fc7ea473a83f25e5449d25806c1902bc8b90c085e21b7da6e064073