GCVE-110-OSM-2026-8349

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. Entrypoint: callback.js (install-hook: node callback.js) Payload: callback.js Key findings: - OAST/Interactsh Exfiltration in callback.js: "oastify.com" - Publisher Has Other Malicious Packages - System Information Exfiltration in callback.js: "os.hostname()||"x")).digest("hex").slice(0,16),n=crypto.randomBytes(4).toString(..." - HTTP Data Exfiltration in callback.js: "os.hostname()||"x")).digest("hex").slice(0,16),n=crypto.randomBytes(4).toString(..." - Install Hook Executes Local JS File in package.json: ""postinstall":"node callback.js"" IOCs: - payloadFileHash: e34cbe5f726d692d9721ce683c7daa6538db61ff75cae13923255220acf50606