GCVE-110-OSM-2026-8886

The package describes itself as "A utility package that reports runtime errors to Sentry using @sentry/node.". However, this is a malicious package which has a preinstall hook that installs dependencies and immediately executes `examples/verify.js`, which in turn loads `src/index.js` — code that runs on every install without user consent. The `dynamic-code-execution` finding (`exec(body)`) in `src/index.js` exfils system and user data and then exfils it to a sentry endpoint. Unfortunately, that's just the first stage; the second stage is that this package installs the known DPRK malicious package base58-core, which is a cryptostealer and RAT. ENTRY examples/verify.js (install-hook: npm install @sentry/node && node examples/verify.js) - Install Hook Executes Local JS File in package.json EXFIL - Suspicious Domain in src/index.js: "https://1.1.1.1" - uses the legitimate https://1.1.1.1/cdn-cgi/trace url to identify public IP ADDITIONAL FINDINGS - Dynamic Code Execution in src/index.js: "exec(body)" - imports the malicious base58-core package in index.js PAYLOAD FILES src/index.js INDICATORS (IOCs) - payloadFileHash: 584db660531edc87550305a4992a166493a9e5a99a6fd71898cef04c4a07f8f4