GCVE-110-OSM-2026-9646

This package implements a Kubernetes cluster reconnaissance and exfiltration attack disguised as a date formatting utility. The postinstall script in package.json performs systematic environment fingerprinting: it enumerates kernel version, network interfaces, probes Kubernetes API server ports (6443, 10250), queries AWS/Alibaba Cloud IMDS endpoints (169.254.169.254 and 100.100.100.200), scans internal subnet hosts across multiple ports, reads DNS config and service account tokens at /var/run/secrets/kubernetes.io/serviceaccount/, and pipes all collected output to the OAST exfil endpoint safjhdvsfwzhieemkdzbgr54r0yjhrmok.oast.fun/escinfo9. The postinstall.js additionally collects system user info via os.userInfo() and exfiltrates to a hard coded IP address. The Chinese-language comment in postinstall.js ('// 1. 定义窃取目标：用户的 SSH 私钥目录' — 'define theft target: user SSH private key directory') confirms SSH credential theft intent beyond the Kubernetes recon. The index.js decoy is a trivial date formatter with no connection to the malicious payload, a classic supply-chain attack pattern. ENTRY index.js (main: index.js) - Postinstall Script in package.json: ""postinstall": "{ echo =ID=; uname -r 2>&1; ip -o addr 2>/dev/null | grep -w ine..." DESTINATION - 9 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in package.json: ".oast.fun" - Suspicious Domain in package.json: "oast.fun" - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.userInfo()" PAYLOAD FILES postinstall.js