GCVE-110-OSM-2026-1214

Reconnaissance payload and attacker footprint confirmation. Exfiltrates system identity (id, hostname, uname -a, ip addr), the complete process environment (process.env — all container secrets), /etc/passwd, running process list (ps aux), Strapi database config file, .env file, network state (ss -tlnp), container runtime info (/proc/1/cgroup), Redis server info, and PostgreSQL version. All data POST to 144.31.107.231:9999. Although the simplest payload in the campaign, it confirms the attacker's postinstall.js (40 lines): Minimal but complete reconnaissance payload. execSync() calls: id, hostname, uname -a, ip addr, process.env (all vars), cat /etc/passwd, ps aux, cat /app/config/database.js, find database.js, cat /app/.env, ss -tlnp, cat /proc/1/cgroup, redis-cli INFO, psql SELECT version(). No sandbox detection. No pg module — relies on CLI tools. Final send: 'rce-done' with 'COMPLETE'.