GCVE-110-OSM-2026-7038

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://user:token@host (primary, plaintext) in scripts/postinstall.js - custom-c2: https://host (plaintext) in scripts/postinstall.js - custom-c2: npm-package-logger-228835561205.europe-west1.run.app (plaintext) in scripts/postinstall.js EXFIL - Git Configuration Access in scripts/postinstall.js: ".gitconfig" - Network Request in scripts/postinstall.js: "https.request(" - System Information Collection in scripts/postinstall.js: "os.userInfo()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Platform Detection with Data Collection in src/stream-to-response.ts: "JSON.stringify({ type: "error", error: String(err) })}\n\n`) ); controller.clos" - Brand New Package - Rapid Version Publishing PAYLOAD FILES scripts/postinstall.js INDICATORS (IOCs) - payloadFileHash: 87d68719e40fc5ae1cfea154b9ca0e3dad3c6e04961752ae82b88e9be2ff03d5