GCVE-110-OSM-2026-1263

Launches a persistent background reverse shell (python3/perl) connecting to attacker C2 at 144.31.107.231:4444 during npm postinstall, while simultaneously exfiltrating Docker container configurations and environment variables via a /proc/1/root container escape to 144.31.107.231:9999. Targets Guardarian cryptocurrency infrastructure with sandbox evasion that exits when run in TRANSFER directories or Windows environments. postinstall.js hardcodes C2 IP 144.31.107.231. On execution: (1) sends hostname/uid beacon to port 9999; (2) spawns detached python3 reverse shell to port 4444 (perl fallback); (3) escapes container via /proc/1/root and reads all Docker container config.v2.json files, POSTing container names, images, and env vars (especially ELASTIC* credentials) in chunks to /exfil/<tag> endpoints on port 9999. Sandbox evasion exits early if cwd contains 'TRANSFER' or uname returns 'MINGW'.