Source: amazon-inspector (4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590)

upload-to-gcp@3.2.1 runs a postinstall lifecycle script on npm install that collects host identifiers (os.hostname(), process.platform, process.arch, Node version, package name, npm lifecycle event) and POSTs them to a hardcoded remote endpoint at https://z5owtt3g.instances.poc.jchunt.top/upload-to-gcp. The destination is a random-looking subdomain not associated with Google Cloud Platform or any documented first-party service, and the transmission occurs automatically at install time with no opt-in and no disclosure. The package name suggests a GCP upload utility, which is inconsistent with the observed beaconing behavior to an unrelated host.

Credit: OpenSSF (source)

References

• https://github.com/ossf/malicious-packages/blob/511adca0dc61308348c08516b5957fd3accecf0a/osv/malicious/npm/upload-to-gcp/MAL-2026-14067.json
• https://www.npmjs.com/package/upload-to-gcp/v/3.2.1