GCVE-110-OSM-2026-9506

This package implements a classic supply-chain reconnaissance payload: on install (via preinstall hook executing vishu.js), it fetches the victim's public IP via ipify.org, then exfiltrates that IP plus CI/CD environment variables (GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, etc.) to a webhook.site endpoint. A secondary DNS-based OAST ping encodes the victim's hostname into a subdomain query to your-collab-domain.oastify.com, providing out-of-band confirmation of execution. The attacker model is CI/CD pipeline fingerprinting — identifying which GitHub Actions runners or build environments installed the package — a well-known tactic associated with supply-chain compromise campaigns. The package name 'pp-react-worldready' is a typosquat/dependency confusion target against the legitimate PayPal react-worldready ecosystem, published by a brand-new account (sevice1825@copawoke.com) with zero history. ENTRY vishu.js (install-hook: node vishu.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in vishu.js: "oastify.com" - Network Request in vishu.js: "https.request(" - System Information Collection in vishu.js: "os.hostname()" - DNS Lookup in vishu.js: "dns.lookup(" - Suspicious Domain in vishu.js: "oastify.com" ADDITIONAL FINDINGS - Brand New Package PAYLOAD FILES vishu.js