GCVE-110-OSM-2026-6918

Malicious package detected. Behaviors: data exfiltration, network activity, install-time execution. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://130.49.177.51:18080/p/dc-20260627-yandex-geobase (primary, plaintext) in postinstall.js - custom-c2: 130.49.177.51 (plaintext) in postinstall.js EXFIL - Data Encoding for Exfiltration in postinstall.js: "encodeURIComponent(pkg.name" - Network Request in postinstall.js: "http.get(" - Suspicious Domain in postinstall.js: "http://130.49.177.51" ADDITIONAL FINDINGS - Rapid Version Publishing PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: 4511fad6b3a02db6a7d6ceffff5f43aff822a423a273336b0dfb0aa02c28bade