GCVE-110-OSM-2026-1209

Targets the host filesystem via /proc/1/root container escape path to exfiltrate: /opt/secrets/*.env (Jenkins deploy secrets), SSH private keys (/root/.ssh/id_rsa, id_ed25519), Jenkins credentials.xml files, Docker container configs (config.v2.json), docker-compose.yml files, and cryptocurrency wallet/payment private keys from any .env files on the host. All data exfiltrated via HTTP POST to 144.31.107.231:9999. postinstall.js (121 lines): Uses HR='/proc/1/root' to access the host filesystem from within the container. (1) /opt/secrets/: ls -la, cat *.env, find -type f -exec cat. (2) SSH keys: id_rsa, id_ed25519, authorized_keys, known_hosts, ssh config, all home directory SSH keys. (3) Docker: cat config.v2.json for all running containers, docker-compose files. (4) /opt/, /data1/ directory enumeration + all *.env files. (5) /etc/ crontab, environment file, systemd unit files. (6) Jenkins: find credentials.xml, read content, find jenkins/secrets/ path. (7) Crypto wallet hunting: find *.env | xargs grep -i 'wallet|private|mnemonic|seed|hot|cold|payout|deposit'. (8) Host process list from /proc/PID/cmdline. (9) Git repos and .git-credentials on host.