GCVE-110-OSM-2026-1379

Exfiltrates crypto wallet config files (id.json, config.toml, .env) and environment files to attacker-controlled endpoint https://cloudflare-protection.vercel.app/api/v1 via HTTP POST at require() time. Recursively searches process.cwd() for matching files and prepends a victim identifier ({USER}@{localIP}) to each upload; local IP is discovered via UDP probe to 8.8.8.8:80. Payload is J2TEAM-obfuscated. On module load, getLocalIp() opens a UDP dgram socket to 8.8.8.8:80 to resolve the local IP. findFilesRecursive() walks process.cwd() collecting files matching [id.json, config.toml, Config.toml, env, .env]. Each file is read synchronously and POST'd as application/octet-stream to API_URL with a prefix header '{USER}@{localIP}\n' prepended to the file content. Full source is J2TEAM string-array-rotation obfuscated.