GCVE-110-OSM-2026-7213

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "node -e \"" DESTINATION - custom-c2: http://109.123.247.172/npm/ue_jenkins_buildkite (primary, plaintext) in package.json - custom-c2: npm.epic-dc.oast.fun (plaintext) in package.json - custom-c2: 109.123.247.172 (plaintext) in package.json EXFIL - OAST/Interactsh Exfiltration in package.json: ".oast.fun" - Network Request in package.json: "request({\n hostname: url.hostname,\n port: url.port || (url.protocol === 'https..." - System Information Collection in package.json: "os.userInfo()" - DNS Lookup in package.json: "dns.lookup(" - Suspicious Domain in package.json: "oast.fun" ADDITIONAL FINDINGS - Brand New Package