GCVE-110-OSM-2026-7501

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY callback.js (install-hook: node callback.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - discord-webhook: https://discord.com/api/webhooks/1522576351318638612/ONCJlNzz7qSy21aKVudMGYMgAadu2s5IRzCWi0s5LsLv0HWHCMra7FH8VJkcdvByEnZe (primary, plaintext) in callback.js EXFIL - Webhook Data Exfiltration in callback.js: "discord.com/api/webhooks/1522576351318638612/ONCJlNzz7qSy21aKVudMGYMgAadu2s5IRzC..." - Network Request in callback.js: "https.request(" - System Information Collection in callback.js: "os.userInfo()" - DNS Lookup in callback.js: "dns.resolve(" ADDITIONAL FINDINGS - Shell Command Execution in callback.js: "require('child_process')" - AWS Credential Access in callback.js: "process.env.AWS_ACCESS_KEY_ID" - Publisher Has Other Malicious Packages PAYLOAD FILES callback.js INDICATORS (IOCs) - payloadFileHash: 62033b091c29ce67c88b6494cddbb313dc2c6bbc063f984a4ed5171ac7f7397a