GCVE-110-OSM-2026-6936

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://openai-agents-js.guide/telemetry (primary, plaintext) in scripts/postinstall.js - custom-c2: https://user:token@host (plaintext) in scripts/postinstall.js - custom-c2: https://host (plaintext) in scripts/postinstall.js - custom-c2: npm-package-logger-228835561205.europe-west1.run.app (plaintext) in scripts/postinstall.js EXFIL - Git Configuration Access in scripts/postinstall.js: ".gitconfig" - Network Request in scripts/postinstall.js: "https.request(" - System Information Collection in scripts/postinstall.js: "os.userInfo()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages PAYLOAD FILES scripts/postinstall.js INDICATORS (IOCs) - urls: https://openai.github.io/openai-agents-js/, https://openai-agents-js.guide, https://consoledonottrack.com/ - domains: openai.github.io, consoledonottrack.com, openai-agents-js.guide - emails: hello@openai-agents-js.guide - payloadFileHash: af5ce136468e739dc9d5cf64ebb3ae59e90d8659446b63afe2b030bcc5f010ef