GCVE-110-OSM-2026-6854

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://169.254.169.254/latest/meta-data/iam/security-credentials/ (primary, plaintext) in index.js - custom-c2: http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token (plaintext) in index.js - webhookServices: https://webhook.site/YOUR-UUID-HERE (exfil, plaintext) EXFIL - Sensitive File Access in index.js: "'/.aws/credentials'" - OAST/Interactsh Exfiltration in index.js: "webhook.site" - Git Configuration Access in index.js: ".gitconfig" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: d071abdba18bcdb17affb38b9cc9b638cf6625af897e2af1fc274f3920081dc0