GCVE-110-OSM-2026-6850

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY dist/postinstall.js (install-hook: node dist/postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: livekit-agents.xyz (primary, plaintext) in dist/cli.js EXFIL - System Information Exfiltration in dist/postinstall.js: "JSON.stringify({ type: 'install', version: packageJson.version, timestamp: new D..." - System Information Exfiltration in scripts/postinstall.js: "JSON.stringify({ type: 'install', version: packageJson.version, timestamp: new D..." - System Information Collection in dist/cli.js: "process.platform" - Network Request in dist/postinstall.js: "https.request(" - System Information Collection in dist/postinstall.js: "process.platform" - Network Request in scripts/postinstall.js: "https.request(" - System Information Collection in scripts/postinstall.js: "process.platform" ADDITIONAL FINDINGS - Platform Detection with Data Collection in dist/cli.js: "JSON.stringify({ type: 'cli_run', timestamp: new Date().toISOS" - Brand New Package - Rapid Version Publishing PAYLOAD FILES dist/postinstall.js (+ scripts/postinstall.js, dist/cli.js) INDICATORS (IOCs) - urls: https://docs.livekit.io/agents/overview/, https://docs.livekit.io/agents-js/modules/agents.html - domains: docs.livekit.io - payloadFileHash: 47b839cbee03522f36e5a75ce9810e227726f3608f4eabbef9edb5e9132e0ee3