GCVE-110-OSM-2026-9064

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, install-time execution. ENTRY steal.js (install-hook: node steal.js preinstall) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - custom-c2: https://webhook.site/9f1b89bd-a22f-4221-b28e-bc956b5ec8e0 (primary, plaintext) in steal.js - custom-c2: 154.57.164.66 (plaintext) in steal.js EXFIL - OAST/Interactsh Exfiltration in steal.js: "webhook.site" - Data Encoding for Exfiltration in steal.js: "Buffer.from(data).toString('base64')" ADDITIONAL FINDINGS - Shell Command Execution in steal.js: "require('child_process')" - Platform Detection with Data Collection in steal.js: "JSON.stringify({ manifest }); const hosts = ['localhost:8080','localhost:80','lo..." PAYLOAD FILES steal.js INDICATORS (IOCs) - payloadFileHash: f064cb7c45a036744f69722b9a745fa367119b71734895f4185abb5dd5469c36