GCVE-110-OSM-2026-6913

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution. ENTRY callback.js (install-hook: node callback.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - custom-c2: https://eolxuw8fddeyjj8.m.pipedream.net (primary, plaintext) in callback.js - custom-c2: 4cyx1u2wzgs8wpgmy4rq1nrvm.canarytokens.com (plaintext) in callback.js - custom-c2: eolxuw8fddeyjj8.m.pipedream.net (plaintext) in callback.js EXFIL - OAST/Interactsh Exfiltration in callback.js: "pipedream.net" - Data Encoding for Exfiltration in callback.js: "encodeURIComponent(token" - Network Request in callback.js: "https.get(" - System Information Collection in callback.js: "os.userInfo()" - DNS Lookup in callback.js: "dns.resolve(" ADDITIONAL FINDINGS - Brand New Package PAYLOAD FILES callback.js INDICATORS (IOCs) - payloadFileHash: 5552a7029e119325c9623ab04ba83ea9d73d793a75fdabae1a7a5a9929095d1d