GCVE-110-OSM-2026-9099

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, network activity, install-time execution. ENTRY preinstall.js (install-hook: node preinstall.js || true) - Install Hook Executes Local JS File in package.json DESTINATION - oast: https://rmknhtfmmidejheotogony3qpqrk75wdz.oast.fun/cb2? (primary, plaintext) in preinstall.js - custom-c2: rmknhtfmmidejheotogony3qpqrk75wdz.oast.fun (plaintext) in preinstall.js - custom-c2: 1.1.1.1 (plaintext) in preinstall.js EXFIL - OAST/Interactsh Exfiltration in preinstall.js: ".oast.fun" - Data Encoding for Exfiltration in preinstall.js: "encodeURIComponent(os.hostname" - Network Request in preinstall.js: "https.get(" - System Information Collection in preinstall.js: "os.userInfo()" - Suspicious Domain in preinstall.js: "oast.fun" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Shell Command Execution in preinstall.js: "require('child_process')" - Brand New Package - Rapid Version Publishing PAYLOAD FILES preinstall.js INDICATORS (IOCs) - payloadFileHash: b39ca76621e58131111664df30a0af4a965f7cf896a0b1f6f1f265762129ed4e