GCVE-110-OSM-2026-6924

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, network activity, install-time execution. ENTRY beacon.js (install-hook: node beacon.js) - Install Hook Executes Local JS File in package.json EXFIL - OAST/Interactsh Exfiltration in beacon.js: "oastify.com" - Data Encoding for Exfiltration in beacon.js: "Buffer.from(who).toString('base64')" - Network Request in beacon.js: "https.get(" - DNS Lookup in beacon.js: "dns.lookup(" - Suspicious Domain in beacon.js: "oastify.com" ADDITIONAL FINDINGS - Shell Command Execution in beacon.js: "require('child_process')" - Brand New Package - Rapid Version Publishing PAYLOAD FILES beacon.js INDICATORS (IOCs) - urls: https://example.invalid/authorized-bbp-poc - payloadFileHash: 395a88912555d89f172d58242e2b84b6fc5fb072cc2651868708321f1f91f463