GCVE-110-OSM-2026-9235

This package is almost certainly a typosquatting attack on the popular 'concurrently' npm package (parallely vs concurrently), published by a brand-new single-package account ('wispnode') with a randomly-generated-looking email address ('wispnode-aew8ad@wshu.net'). The package impersonates concurrently by copying its author name (Kimmo Brunfeldt), homepage, and repository URL. Most code matches the legitimate concurrently source, but `dist/lib/spawn.js` contains an anomalous HTTP GET request (`request({ method: 'GET', hostname: d.hostname, port: d.port ... })`) that does not appear in the genuine concurrently spawn implementation — process runners do not need to make outbound HTTP calls. This GET request is paired with silent subprocess execution (`stdio: 'ignore'`), which together suggest a covert callback or C2 beacon that was not captured in the exfil analysis, possibly because the destination URL is computed at runtime. Without a confirmed exfil destination, the verdict stops at suspicious rather than malicious, but the combination of typosquatting identity, new publisher, and anomalous network logic in spawn.js warrants immediate takedown consideration. ENTRY dist/bin/index.js (bin: ./dist/bin/index.js) EXFIL - Network Request in dist/lib/spawn.js: "request({ method: "GET", hostname: d.hostname, port: d.port || (d.protocol === "..." - System Information Collection in dist/lib/spawn.js: "process.platform" ADDITIONAL FINDINGS - Dynamic Code Execution in dist/lib/command-parser/expand-wildcard.js: "exec(scriptGlob)" - Shell Command Execution in dist/lib/spawn.js: "require("child_process")" - Silent Process Execution in dist/lib/spawn.js: "stdio: "ignore"" - Shell Command Variable Setup in dist/lib/spawn.js: "'cmd.exe' : '/bin/sh'" PAYLOAD FILES dist/lib/spawn.js INDICATORS (IOCs) - urls: https://yarnpkg.com/, https://pnpm.io/, https://bun.sh/, https://nodemon.io/, https://serverfault.com/a/208266/160539 - domains: www.unicode.org, yarnpkg.com, pnpm.io, bun.sh, options.group (+4 more) - payloadFileHash: 35496f986465690f27e8e6f36c31ad458a414379f3e7438e12b5270509f33721