GCVE-110-OSM-2026-9249

This package is a cloud environment reconnaissance and credential theft tool disguised as a string formatting utility. The postinstall.js script runs immediately on npm install via a postinstall hook and executes a shell pipeline that probes IMDS endpoints for AWS (169.254.169.254), GCP (metadata.google.internal), Azure, Alibaba Cloud (100.100.100.200), and Tencent Cloud (metadata.tencentyun.com), including explicit harvesting of AWS IAM security credentials stored to /tmp/.iam-creds. All collected data (hostname, username, cloud vendor, instance IDs, MAC addresses, IAM role names, and credential blobs up to 800 chars) is exfiltrated via a single curl GET request to the attacker-controlled OAST endpoint pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The comment '// v11: 云厂商元数据探测版' indicates this is an iterated campaign targeting cloud-deployed CI/CD or developer environments. The package has zero legitimate functionality and minimal metadata, consistent with a throwaway supply-chain attack package. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: http://metadata.tencentyun.com/latest/meta-data/ (primary, plaintext) in postinstall.js - custom-c2: http://169.254.0.23/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: http://metadata.tencentyun.com/latest/meta-data/instance-id (plaintext) in postinstall.js - custom-c2: http://metadata.tencentyun.com/latest/meta-data/mac (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/ (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/iam/security-credentials/ (plaintext) in postinstall.js - custom-c2: http://169.254.169.254/latest/meta-data/instance-id (plaintext) in postinstall.js - custom-c2: http://100.100.100.200/latest/meta-data/ (plaintext) in postinstall.js (+7 more) EXFIL - OAST/Interactsh Exfiltration in postinstall.js: "oastify.com" - Suspicious Domain in postinstall.js: "oastify.com" ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" PAYLOAD FILES postinstall.js INDICATORS (IOCs) - payloadFileHash: cd9315d4631bfde5bfe82042b45105c9f42839f41b7b39261e4358957a5f9f3a