GCVE-110-OSM-2026-1126

Exfiltrates system reconnaissance data (hostname, username, current working directory, Node.js version, public IP address, and CI/CD environment indicators) to attacker-controlled IP 69.164.221.216:8080 and a Discord webhook during the preinstall phase, before any package code is loaded. preinstall.js fetches the victim's public IP from api.ipify.org, then fires two simultaneous POST requests: (1) HTTP POST to http://69.164.221.216:8080/callback with JSON body containing hostname, username, cwd, node version, CI indicators, and public IP; (2) HTTPS POST to a hardcoded Discord webhook (ID 1484422878647816244) with the same data formatted as a Discord embed. All network errors are silently swallowed.