GCVE-110-OSM-2026-9511

Typosquat of the well-known is-odd package (copied name, description, README, and false author credit to Jon Schlinkert). The legitimate-looking index.js is a decoy; the actual payload is index.min.js, obfuscated with Obfuscator.io techniques (string-array rotation, hex identifiers) and executed automatically via a postinstall hook ("postinstall": "node index.min.js"). On every install it silently opens an outbound HTTP connection to a hardcoded external IP — a classic install-time beacon / first-stage check-in. Detected by static analysis (OBF-028 obfuscator.io string-array rotation, OBF-014 hex identifiers, MANIFEST-007 install-hook execution) and confirmed by manual code review including deobfuscation. Publisher identity unknown (npm has taken the package down and stripped maintainer data). SHA-256 of package tarball: 4adae43c35fac26e0965c8ee525e6b54f4ec129c52274b8ecb5ca6bbe1b213aa index.min.js (Obfuscator.io-wrapped) deobfuscates to a Node HTTP beacon: POSTs JSON {"message":"Hello World"} to hardcoded http://144.172.91.84:3000/hello using require('http'), with a response handler in place to receive server instructions. No host data is sent in this version, but the beacon confirms compromise to the operator and the response channel allows follow-up instructions — and since the hook runs at install time with the victim's privileges, a server-side change can upgrade the behavior at any moment. IOCs: IP 144.172.91.84 (port 3000, path /hello); file index.min.js; postinstall hook in package.json.