GCVE-110-OSM-2026-9564

The package executes a postinstall hook (`node src/test.js`) that fetches arbitrary code from a custom C2 endpoint (`https://workconfig.vercel.app`) and executes it immediately via `new Function('require', data.toString())(require)` — a classic remote code execution loader pattern. The `rejectUnauthorized: false` flag suppresses TLS validation, a common attacker technique to avoid certificate pinning issues. The publisher (`maebinond`) has zero prior packages, a generic author field ('Your Name'), no repository, and a Gmail-based email, all consistent with a throwaway account used for malware distribution. The attacker model is a supply-chain loader: install the package, phone home to C2, execute whatever payload the server returns with full Node.js require access. ENTRY src/test.js (install-hook: node src/test.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in src/test.js: "https.get(" PAYLOAD FILES src/test.js