GCVE-110-OSM-2026-1211

Exfiltrates the complete process environment (all non-npm_ variables) including DATABASE_PASSWORD, JWT_SECRET, API_KEY, STRIPE_SECRET_KEY, or any other secrets set in the container environment. Also reads /app/config/database.js and /app/.env directly, dumps all Redis keys (via redis-cli), and probes the PostgreSQL version. All exfiltrated to 144.31.107.231:9999. postinstall.js (70 lines): (1) Iterates process.env, excludes npm_* variables, POSTs entire environment as JSON to /exfil/env-full. (2) Reads /app/config/database.js (contains DATABASE_HOST, DATABASE_NAME, DATABASE_USERNAME, DATABASE_PASSWORD in plaintext). (3) Reads /app/.env (all environment variable overrides). (4) Redis: redis-cli -h 127.0.0.1 INFO + KEYS '*'. (5) PostgreSQL probe via PGPASSWORD env var: psql -c 'SELECT version()' and psql -c '\dt'. Simpler than other campaign packages but effective — captures all secrets regardless of their names.