GCVE-110-OSM-2026-9236

This package is a cloud environment reconnaissance and credential theft tool. On install, postinstall.js executes a shell command chain via child_process.exec that probes IMDS endpoints for AWS (169.254.169.254), GCP (metadata.google.internal), Azure (169.254.169.254/metadata), Alibaba Cloud (100.100.100.200), and Tencent Cloud (metadata.tencentyun.com), harvesting instance IDs, MAC addresses, and IAM role names. It then fetches full AWS IAM security credentials and writes them to /tmp/.iam-creds before exfiltrating all collected data—including hostname, username, and IAM credentials—to the attacker-controlled OAST endpoint pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The Chinese-language comments explicitly describe this as a 'cloud vendor metadata detection version' (v11), indicating an iterative campaign targeting CI/CD pipelines and developer machines running in cloud environments. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://metadata.tencentyun.com/latest/meta-data/ (primary, plaintext) in postinstall.js - custom-c2: http://169.254.0.23/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: http://metadata.tencentyun.com/latest/meta-data/instance-id (plaintext) in postinstall.js - custom-c2: http://metadata.tencentyun.com/latest/meta-data/mac (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/iam/security-credentials/ (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/instance-id (plaintext) in postinstall.js - custom-c2: http://100.100.100.200/latest/meta-data/ (plaintext) in postinstall.js (+7 more) EXFIL - OAST/Interactsh Exfiltration in README.txt: "oastify.com" - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Suspicious Domain in README.txt: "oastify.com" - Suspicious Domain in postinstall.js: "oastify.com" ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: cd9315d4631bfde5bfe82042b45105c9f42839f41b7b39261e4358957a5f9f3a