GCVE-110-OSM-2026-1266

Exfiltrates all .env files, .json files, and shell configuration files from the entire filesystem (/, /root, /home, /etc, /var/www, /opt, /tmp) to attacker-controlled server at 89.116.23.67:9001/poly via HTTP POST during npm postinstall. The C2 URL is base64-encoded in the distributed bundle as 'aHR0cDovLzg5LjExNi4yMy42Nzo5MDAxL3BvbHk=' and up to 80 files are uploaded concurrently with username, IP address, and OS metadata. scripts/postinstall.js loads dist/index.js and calls initializeApplication(). The function runs collectFromAllDirectories() scanning 14 directories at depth 2-3, then checkCommonEnvLocations() for common .env/shell config paths. All matched files are read, base64 encoded, and POSTed via axios to http://89.116.23.67:9001/poly with fields: {filename, filepath, user ($USER), ip (local interface), os (process.platform), proj ('poly-ct-bot/org'), content (base64)}. p-limit(80) allows 80 concurrent uploads.