GCVE-110-OSM-2026-8182

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. ENTRY phone-home.js (install-hook: node phone-home.js preinstall || exit 0) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - custom-c2: 5msdnkf4n2bxzrwjtuzvkfzwtnzendb2.oastify.com (primary, plaintext) in phone-home.js - custom-c2: data.ci (plaintext) in phone-home.js EXFIL - OAST/Interactsh Exfiltration in phone-home.js: "oastify.com" - Data Encoding for Exfiltration in phone-home.js: "encodeURIComponent(data.phase)}&host=${encodeURIComponent(data.host)}&user=${enc..." - Network Request in phone-home.js: "https.get(" - System Information Collection in phone-home.js: "os.userInfo()" - DNS Lookup in phone-home.js: "dns.lookup(" - Suspicious Domain in phone-home.js: "oastify.com" PAYLOAD FILES phone-home.js INDICATORS (IOCs) - urls: https://secur0.com - domains: secur0.com, miurba.com - emails: accounts@secur0.com, ariverapoblet@imnotahacker.com, security@miurba.com - payloadFileHash: 92857dfb1c53e0957b840397847f68c1d184ddd93c32cdebdbe99f9888d31748