GCVE-110-OSM-2026-9644

This package implements a classic reverse shell payload executed on install via a postinstall hook. The entrypoint file postinstall.js contains an immediately-invoked function that spawns a /bin/sh process, creates a TCP socket connection to an ngrok tunnel used to route traffic to an attacker-controlled host, and pipes stdin/stdout/stderr bidirectionally — giving the attacker full interactive shell access on the victim's machine. The package has zero metadata (no description, no repository, no author), consistent with a throwaway burner package. The attacker model is straightforward: a developer installs the package, the postinstall script fires, and the attacker receives a shell session through their ngrok tunnel. ENTRY postinstall.js (install-hook: node postinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Suspicious Domain in postinstall.js: "ngrok.io" ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require("child_process")" - Ngrok Tunneling Service in postinstall.js: "ngrok.io" PAYLOAD FILES postinstall.js