GCVE-110-OSM-2026-1392

Exfiltrates sensitive project files — including .env, config.toml, and id.json — to attacker-controlled endpoint https://npmjs-doc-builder.vercel.app/api/v1 via axios POST in binary with username and local IP prefix. Recursively scans process.cwd() for credential and config files; uses UDP dgram probe to 8.8.8.8:80 for IP detection. Masquerades as a documentation builder utility. index.js decodes API_URL from base64 and exports from_str() which scans recursively for files matching id.json, config.toml, Config.toml, .env, env, and ======. Each matched file is read with fs.readFileSync, prefixed with '{USER}@{localIP}\n', and POSTed as application/octet-stream with Content-Disposition: attachment to the C2. Local IP is determined via UDP dgram socket connecting to 8.8.8.8:80 without sending data.