GCVE-110-OSM-2026-7495

Malicious package detected. Behaviors: data exfiltration, install-time execution. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Sensitive File Access in postinstall.js: "'.ssh/id_rsa'" - HTTP Data Exfiltration in postinstall.js: "process.cwd() }, secrets: secrets }; const body = JSON.stringify(payload); const..." - Git Configuration Access in postinstall.js: ".gitconfig" - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.userInfo()" ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: 74352ce52ec36ad21519b8b7c574f2d6c5836be9ec1ed97ceb26901bd89a2cfb