GCVE-110-OSM-2026-1210

Reads live PostgreSQL credentials from the deployment environment (DATABASE_HOST, DATABASE_PORT, DATABASE_NAME, DATABASE_USERNAME, DATABASE_PASSWORD) and uses them to dump every table in the database including strapi_administrator, users-permissions_user, core_store (JWT secrets), and all other tables (SELECT * LIMIT 100). Also performs a full Redis dump (all keys + values using ioredis/redis client), checks for AWS credentials in environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) postinstall.js (259 lines): (1) Reads DB credentials from process.env: DATABASE_HOST, DATABASE_PORT, DATABASE_NAME, DATABASE_USERNAME, DATABASE_PASSWORD — uses actual deployment credentials, not a hardcoded fallback. (2) Dumps ALL tables (no filter): for each table, SELECT * LIMIT 100 — indiscriminate full schema exfiltration. (3) Redis: attempts ioredis then redis module; dumps INFO + KEYS * + values for all 200 keys (strings, hashes, lists, sets). (4) AWS: if AWS_ACCESS_KEY_ID present, exfiltrates key+secret+region; runs aws s3 ls, aws sts get-caller-identity, aws ec2 describe-instances. (5) Reads /app/config/*.js, helpers/, extensions/, SSH keys, crontab, /etc/hosts.