GCVE-110-OSM-2026-7215

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "node -e \"" DESTINATION - custom-c2: http://109.123.247.172/npm/robomerge (primary, plaintext) in package.json - custom-c2: robomerge.npm.epic-dc.oast.fun (plaintext) in package.json - custom-c2: 109.123.247.172 (plaintext) in package.json EXFIL - OAST/Interactsh Exfiltration in package.json: ".oast.fun" - Network Request in package.json: "request({\n hostname: url.hostname,\n port: url.port || (url.protocol === 'https..." - System Information Collection in package.json: "os.userInfo()" - DNS Lookup in package.json: "dns.lookup(" - Suspicious Domain in package.json: "oast.fun" ADDITIONAL FINDINGS - Platform Detection with Data Collection in package.json: "JSON.stringify({\n type: 'npm',\n phase: 'preinstall',\n package: 'robomerge',\n..." - Brand New Package