GCVE-110-OSM-2026-8854

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity, install-time execution. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://storage.googleapis.com/lscunpentest/pack..." - Install Hook Executes Local JS File in [ltidisafe] package/package.json: ""preinstall": "node test.js > /dev/null 2>&1"" EXFIL - OAST/Interactsh Exfiltration in [ltidisafe] package/test.js: "oastify.com" - Network Request in [ltidisafe] package/index.js: "http.request(" - System Information Collection in [ltidisafe] package/test.js: "os.hostname()" - Suspicious Domain in [ltidisafe] package/test.js: "oastify.com" OBFUSCATION - recovered 2 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages PAYLOAD FILES [ltidisafe] package/test.js INDICATORS (IOCs) - domains: s.ls.ls.ls, ux-foundry.wwwz15e554m201wwajfl7m1ey54z1nq.oastify.com