GCVE-110-OSM-2026-9565

The package executes a postinstall hook that fetches remote code from `https://workconfig.vercel.app` and immediately evaluates it via `new Function('require', data.toString())(require)` — a classic remote-code-execution loader pattern. The attacker model is a supply-chain stager: on install, the package silently downloads and executes an arbitrary payload from a custom C2 hosted on Vercel, with TLS verification disabled (`rejectUnauthorized: false`) to prevent certificate pinning interference. The publisher account `yanasq77` has zero prior packages, no repository, no homepage, and a generic author field ('Your Name'), all consistent with a throwaway account created solely for this attack. The IOC `workconfig.vercel.app` is classified as a custom C2 exfil endpoint, and the entrypoint file contents confirm the chain: fetch → deserialize → execute with full `require` access. ENTRY src/test.js (install-hook: node src/test.js) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in src/test.js: "https.get(" PAYLOAD FILES src/test.js