GCVE-110-OSM-2026-12220

Package declares a postinstall hook `node exfil_v3.js` that auto-executes on `npm install`. The script harvests installer-side data — HOME, GITHUB_WORKSPACE, GITHUB_RUN_ID, presence of GITHUB_TOKEN, output of `whoami`, `/tmp` directory listing, and the contents of `~/.bashrc`, `~/.bash_profile`, and `/etc/environment` — plus results of a `find` scan for files matching *flag*/*pwn*. The collected JSON payload is POSTed via https.request to a hardcoded webhook.site collector at https://webhook.site/4f4566fc-e72f-415b-818f-fdb42dc9891d. The shell-init and environment files targeted commonly contain exported credentials, and the payload explicitly reports GitHub Actions token presence, indicating targeting of CI runners.