GCVE-110-OSM-2026-9296

A typosquatting package has been identified on npm, masquerading as a legitimate Korean educational tool described as "WHS4 교육용 패키지입니다. typo 발생시 안내합니 다." (translation: "WHS4 educational package. Guides you when typos occur"). Upon installation, the package executes a postinstall hook (node index.js) that silently exfiltrates victim environment data to an attacker-controlled Discord webhook—without user consent or notification. The package's index.js is configured to execute automatically via the postinstall lifecycle hook. Upon installation, it exfiltrates a JSON payload to a Discord webhook (https://discord.com/api/webhooks/1530599209269465319/nldTp8a436wl0307aXLx5ynqxRCCf1tjnCNMrGZdj3oHzYNo6lrQTAAsBHuPjfvMDX77). Exfiltrated Data: Absolute filesystem path (sendFullPath: true) — leaks the victim's username and directory structure Node.js version — environment fingerprinting Platform and architecture — targeting reconnaissance Evasion Technique: The webhook URL is deliberately split across two concatenated string literals ('…webhooks/1530599209269465319/' + 'nldTp8a4…'), a clear indicator of malicious intent designed to bypass static analysis scanners. Verdict: The package contains zero legitimate functionality. Its sole purpose is reconnaissance and data exfiltration. Hashes: Tarball SHA-256: d3c1e555f48014248648e307b257236cfacef059f9bdcd5e92d92252b90a0fde Registry SHA-1: 34eb55a90df4112652e2fa2d5739ee5de285a3be