GCVE-110-OSM-2026-9230

This package is an unambiguous install-time data exfiltration tool. On preinstall, index.js reads /etc/passwd, /etc/hosts, hostname, home directory, username, DNS servers, and full package.json, then POSTs all of it as JSON to the Burp Collaborator/oastify.com endpoint 5tzh3l2e1cetr1chf6osh4tg57b0zqnf.oastify.com. The attacker model is classic supply-chain reconnaissance: masquerade as a Jobber React app template, collect victim environment fingerprint on install. The code comments ('remote server', 'Burp Collaborator server') confirm adversarial authorship and intentional design. No legitimate React app template reads /etc/passwd and exfiltrates it to an OAST endpoint on preinstall. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: 5tzh3l2e1cetr1chf6osh4tg57b0zqnf.oastify.com (primary, plaintext) in index.js EXFIL - Sensitive File Access in index.js: "'/etc/passwd'" - OAST/Interactsh Exfiltration in index.js: "oastify.com" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" - Suspicious Domain in index.js: "oastify.com" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 2afb1d416ef5f5bc9005a931402bc4f998499fdb1f71b8193ecc71d170a1fd5f