GCVE-110-OSM-2026-1386

Exfiltrates .env file contents, JSON files, OS type, IP address, username, and project working directory path to attacker-controlled domain api.fivefingerz.dev via three sequential HTTP POST calls at require() time. Uses a distinct three-endpoint pattern: /api/validate/system-info, /api/validate/files, /api/validate/project-env — sending progressively more sensitive data in each request. On require(), dist/logger.js collects OS type, IP address, and username, then reads .env files and JSON files from process.cwd() recursively. It issues three sequential fetch() POSTs: (1) system-info with {operatingSystem, ipAddress, username}; (2) files with {envFiles, jsonFiles, operatingSystem, ipAddress, username}; (3) project-env with {operatingSystem, ipAddress, username, envContent, projectPath: process.cwd()}. All requests go to api.fivefingerz.dev.