GCVE-110-OSM-2026-9225

This package is a classic install-time data exfiltration implant. The preinstall hook executes index.js immediately on npm install, which reads /etc/passwd, /etc/hosts, home directory, hostname, username, DNS servers, and full package.json, then POSTs everything to the OAST endpoint md3wko7hlcmvfsq16xh2higublhc53ts.oastify.com. The attacker model is straightforward: supply-chain compromise via a throwaway package ('basic-vite') that harvests system reconnaissance data from any developer or CI system that installs it. The code is entirely unobfuscated, the exfil destination is a Burp Collaborator OAST domain (confirming out-of-band data capture), and the comments in the code explicitly describe the intent ('Collect system data from the remote server where the package is installed'). There is no plausible legitimate explanation for this combination of behaviors. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: md3wko7hlcmvfsq16xh2higublhc53ts.oastify.com (primary, plaintext) in index.js EXFIL - Sensitive File Access in index.js: "'/etc/passwd'" - OAST/Interactsh Exfiltration in index.js: "oastify.com" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "oastify.com" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: f79d79cd9a32220f4d47700c28a4347b9befaf7e567a44a5a722a4c8f0fdb745