GCVE-110-OSM-2026-7721

This is a textbook dependency confusion attack. The package name mimics 'google-caja' with an artificially inflated version (1000.801.20) to outrank internal packages, and the preinstall hook immediately executes index.js on install. The code explicitly labels itself a 'Dependency Confusion Crawler' in the Discord webhook payload content ('Dependency Confusion Executed'), leaving no ambiguity about attacker intent. On install, it crawls the working directory (up to 500 files), collects hostname, username, platform, and current path, then exfiltrates a directory tree to WEBHOOK_MAP and uploads raw file contents to WEBHOOK_FILES — two hardcoded Discord webhooks in plaintext. The rapid version spam (7 versions in ~75 minutes) and brand-new single-package publisher account are consistent with an active supply chain attack campaign. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - discord-webhook: https://discord.com/api/webhooks/1525551922281578586/NyRpxBSpZEAI2TYjchHrRlqsXpwH5qk70TBeQrQZTH2j0vGOwm_1wIaqPs3DOpIwgoC- (primary, plaintext) in index.js - discord-webhook: https://discord.com/api/webhooks/1525552129572343958/ylicnDNawLzhBNSDeFu2jXQ0t3FtMNc7fQQtmzJ4pbTMOL6LhsbSOO-1gfhoAyUtaix6 (plaintext) in index.js EXFIL - Webhook Data Exfiltration in index.js: "discord.com/api/webhooks/1525551922281578586/NyRpxBSpZEAI2TYjchHrRlqsXpwH5qk70TB..." - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.hostname()" OBFUSCATION - String Array Obfuscation in index.js: "[ '.exe', '.dll', '.so', '.dylib', '.bin', '.iso', '.img', '.zip', '.tar', '.gz'..." ADDITIONAL FINDINGS - Brand New Package - Rapid Version Publishing PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: e0a40904de04fb3727cb8406679c7ad3372e05f8943480d62c815c2b70b44a0b