GCVE-110-OSM-2026-7957

Malicious package detected. Behaviors: data exfiltration, network activity, install-time execution. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: https://ip-api.com/json/ (primary, plaintext) in postinstall.js - custom-c2: p1r2d74iwjk057raam6myf7e258wzkt8i.oastify.com (plaintext) in postinstall.js - custom-c2: ip-api.com (plaintext) in postinstall.js - custom-c2: g.org (plaintext) in postinstall.js EXFIL - Environment Variable Exfiltration in postinstall.js: "process.env.npm_lifecycle_event || !process.env.npm_package_name) process.exit(0..." - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Network Request in postinstall.js: "https.get(" - System Information Collection in postinstall.js: "os.userInfo()" - DNS Lookup in postinstall.js: "dns.lookup(" - Suspicious Domain in postinstall.js: "oastify.com" PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: 4adbfd26be37cb08cc308e2aa23d2319462ad80247ffb54613fd33b30450eb68