GCVE-110-OSM-2026-7668

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - System Information Exfiltration in postinstall.js: "os.hostname(), user: os.userInfo().username, platform: os.platform(), cwd: proce..." - HTTP Data Exfiltration in postinstall.js: "os.userInfo().username, platform: os.platform(), cwd: process.cwd(), node: proce..." - Data Encoding for Exfiltration in postinstall.js: "encodeURIComponent(v)}`).join" - Network Request in postinstall.js: "http.request(" - System Information Collection in postinstall.js: "os.userInfo()" - Suspicious Domain in postinstall.js: "oastify.com" PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: dadaad150a1789aec709a78a41507ff0d88d2ab999dc6622e3574d9ea5f34b49