GCVE-110-OSM-2026-1255

Exfiltrates system info, project .env files, shell history, filesystem credential documents, and Telegram Desktop session data to attacker-controlled domain changelog.rest via HTTP POST on require() and postinstall. On Linux, injects an attacker SSH public key (root@srv141316.hosttoname.com) into ~/.ssh/authorized_keys for persistent backdoor access. Identical payload in cli-pretty-logger@1.0.0 by same publisher (vichevmafaaxe@hotmail.com). dist/logger.js executes immediately on require(). Calls _ssi() to POST system info, _spe() to exfiltrate project .env, _sejf() to scan filesystem for credential files, _saf() to upload collected files, _stia() to package and upload Telegram tdata directory. On Linux _sejf() also calls _ark() which writes attacker RSA key to ~/.ssh/authorized_keys. All exfil to https://changelog.rest/api/validate/*. postinstall runs upgrade.cjs (self-update) then node dist/index.js (triggers payload).