GCVE-110-OSM-2026-9635

This package is a reverse shell trojan disguised as a dependency confusion proof-of-concept. On install, preinstall.js immediately opens a TCP socket to the hardcoded C2 address, spawns cmd.exe, and pipes the shell's stdin/stdout/stderr bidirectionally through the socket — giving the attacker full interactive shell access on the victim machine. The code self-identifies as 'Dependency Confusion RCE PoC' and exfiltrates hostname and username before handing over shell control. The reconnect loop (setTimeout(connect, 3000)) ensures persistence through transient network failures. Whether framed as a PoC or not, this is functional malware that executes on install with no user interaction. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in preinstall.js: "os.userInfo()" ADDITIONAL FINDINGS - Shell Command Execution in preinstall.js: "require('child_process')" PAYLOAD FILES preinstall.js