GCVE-110-OSM-2026-7074

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json EXFIL - Environment Variable Exfiltration in postinstall.js: "process.env).filter(function(k) { return !/^(NODE|npm_|HOME|PATH|SHELL|TERM|LS_|..." - OAST/Interactsh Exfiltration in postinstall.js: "webhook.site" - Environment Variable Exfiltration in preinstall.js: "process.env).filter(function(k) { return !/^(NODE|npm_|HOME|PATH|SHELL|TERM|LS_|..." - OAST/Interactsh Exfiltration in preinstall.js: "webhook.site" - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.hostname()" - Network Request in preinstall.js: "https.request(" - System Information Collection in preinstall.js: "os.hostname()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in postinstall.js: "JSON.stringify({ pkg: '@sudoughnym/enviro-demo', version: '99.99.99', hook: 'pos..." - Brand New Package - Rapid Version Publishing PAYLOAD FILES postinstall.js (+ preinstall.js) INDICATORS (IOCs) - payloadFileHash: 35480f9a23cf1ffa8411c800245005d03fd505010c3320fa0cde3f8076287379