GCVE-110-OSM-2026-7682

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, install-time execution. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - tunnel: https://forward-amber-prairie-ruled.trycloudflare.com/x?d= (primary, plaintext) in install.js EXFIL - OAST/Interactsh Exfiltration in install.js: ".trycloudflare.com" - OAST/Interactsh Exfiltration in postinstall.js: ".trycloudflare.com" - OAST/Interactsh Exfiltration in preinstall.js: ".trycloudflare.com" - OAST/Interactsh Exfiltration in prepare.js: ".trycloudflare.com" - Data Encoding for Exfiltration in install.js: "Buffer.from(msg).toString('base64')" - Data Encoding for Exfiltration in postinstall.js: "Buffer.from(msg).toString('base64')" - Data Encoding for Exfiltration in preinstall.js: "Buffer.from(msg).toString('base64')" - Data Encoding for Exfiltration in prepare.js: "Buffer.from(msg).toString('base64')" (+4 more) ADDITIONAL FINDINGS - Shell Command Execution in install.js: "require('child_process')" - Platform Detection with Data Collection in install.js: "JSON.stringify({manifest:'ecto_module:\n name: PWNED\n version: 1.0.0\n power_le..." PAYLOAD FILES install.js (+ postinstall.js, preinstall.js) INDICATORS (IOCs) - payloadFileHash: 1c33c7ae3c308e1d0e8bde798d15b9b6d01b373f620accbffd045da66d0ec531