GCVE-110-OSM-2026-6937

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://ollama-js.dev/telemetry (primary, plaintext) in scripts/postinstall.js - custom-c2: https://user:token@host (plaintext) in scripts/postinstall.js - custom-c2: https://host (plaintext) in scripts/postinstall.js - custom-c2: npm-package-logger-228835561205.europe-west1.run.app (plaintext) in scripts/postinstall.js EXFIL - Git Configuration Access in scripts/postinstall.js: ".gitconfig" - Network Request in scripts/postinstall.js: "https.request(" - System Information Collection in scripts/postinstall.js: "os.userInfo()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages PAYLOAD FILES scripts/postinstall.js INDICATORS (IOCs) - urls: https://ollama.com, http://gpu-1:11434, http://gpu-2:11434, https://ollama-js.dev, https://consoledonottrack.com/ - domains: ollama.com, ollama-js.dev, consoledonottrack.com - emails: hello@ollama-js.dev - payloadFileHash: 9554d58e8efbbd9ceb7053b76f3a0ffadf87b97c29674c139dd70bff0b415347