GCVE-110-OSM-2026-12070

preinstall.js and postinstall.js execute automatically on npm install. preinstall.js reads.env files from the current and parent directories, walks the working directory and home directory for files matching *.key, *.pem, id_rsa, id_ed25519, wallet.json, keystore.json, and mnemonic.txt, collects process.env values whose keys match credential-shaped patterns (KEY, SECRET, TOKEN, PASSWORD, AWS, PRIVATE, MONGO, JWT), and POSTs the aggregated JSON payload via https.request to https://attacker.com/collect. postinstall.js additionally captures hostname, user, uid/gid, cloud/container context (Docker, Kubernetes, AWS, GCP, Azure), and reads file contents from /root, /home, and /opt matching key/pem/mnemonic/wallet/keystore/secret, then POSTs to https://attacker.com/exfiltrate. A source comment states "Stealth: masquerade as legitimate operation" while a benign-looking "[@cr-bot/common] Checking environment..." message is printed and network errors are silently swallowed. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json - Preinstall Script in package.json EXFIL - Network Request in postinstall.js: "https.request(" - System Information Collection in postinstall.js: "os.userInfo()" - Network Request in preinstall.js: "https.request(" - System Information Collection in preinstall.js: "os.userInfo()" ADDITIONAL FINDINGS - Shell Command Execution in postinstall.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES postinstall.js (+ preinstall.js)