GCVE-110-OSM-2026-1248

Second package published by the same attacker (tikeqemif262@gmail.com) 51 minutes after strapi-plugin-sitemap-gen. postinstall.js is byte-for-byte functionally identical to strapi-plugin-sitemap-gen: same hardcoded C2 VPS (144.31.107.231), same PostgreSQL credentials (user_strapi / 1QKtYPp18UsyU2ZwInVM), same Docker container env var sweep, same SSH key theft, same Python3 reverse shell to port 4444, same SSH persistence tunnel. The two-package campaign broadens the attack surface by targeting developers who install Strapi 'nordica-tools' plugins alongside or instead of 'sitemap-gen' plugins. Identical postinstall.js payload to strapi-plugin-sitemap-gen. All constants, logic, and exfil paths are the same: VPS='144.31.107.231', PORT=9999, reverse shell port 4444, PG creds user_strapi/1QKtYPp18UsyU2ZwInVM, /proc/1/root container escape pattern, Docker config path enumeration, SSH key paths, .env file sweep, Hetzner metadata probe, 172.17.0.x Docker network scan. The only differences are the package name string used in the initial send('sm-start', ...) beacon and the npm package name itself.