GCVE-110-OSM-2026-7072

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, install-time execution. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - custom-c2: http://{target (primary, plaintext) in publish-and-arm.sh - custom-c2: 154.57.164.76 (plaintext) in postinstall.js - webhookServices: https://webhook.site/755defab-ea42-4c1f-9804-43ec567439f5 (exfil, plaintext) EXFIL - OAST/Interactsh Exfiltration in postinstall.js: "webhook.site" - Data Encoding for Exfiltration in postinstall.js: "Buffer.from(data.cwd).toString("base64")" - Data Encoding for Exfiltration in publish-and-arm.sh: "json.dumps({"manifest": manifest}).encode" - Network Request in postinstall.js: "http.request(" - System Information Collection in postinstall.js: "os.hostname()" - Network Request in publish-and-arm.sh: "Request( f"http:" ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require("child_process")" - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({ manifest }); const req = http.request( { hostname: targetHos" PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: 9ca7a71fe48ba9a34e4e71ee46a5e39d0b189a1cf9e3406e7b2d4b7e9888ca19