GCVE-110-OSM-2026-1173

Exfiltrates SSH keys, AWS credentials, cryptocurrency wallet files, .env files, and environment variables containing secrets to attacker-controlled IP 69.42.222.23:5555 via HTTP POST in the postinstall script. Also injects a hardcoded attacker SSH public key into ~/.ssh/authorized_keys to establish persistent backdoor access. postinstall.js is a heavily obfuscated infostealer. When decoded, it builds a multi-section report covering: (1) ~/.ssh/ contents with key previews, (2) env var filtering by sensitive keywords, (3) cloud credential files (AWS, GCP, Azure, Docker, Kube), (4) crypto wallets (Bitcoin wallet.dat, Ethereum keystore, Solana id.json), (5) .env files recursively found in CWD, (6) privilege escalation vectors (sudo, docker/lxd group, SUID). The report is POSTed to http://69.42.222.23:5555/report. A hardcoded attacker SSH public key is appended to ~/.ssh/authorized_keys via execSync, granting persistent SSH access.