GCVE-110-OSM-2026-1398

Collects full process.env (exposing AWS credentials, API keys, npm tokens, and all CI/CD secrets), OS platform, hostname, username, and MAC addresses on require(), then fetches and dynamically executes stage-2 payloads from three attacker-controlled jsonkeeper.com endpoints that exfiltrate the collected data. The malicious code is hidden in lib/writer.js inside a full clone of the legitimate pino logger package. Published by oleksbov (ronaldobon@proton.me). lib/writer.js constructs a data object with spread process.env plus os info and MACs, then performs axios.get on https://jsonkeeper.com/b/NHKA2 and https://jsonkeeper.com/b/I8WZJ, dynamically executing r.data.content from each response. A third C2 URL (https://www.jsonkeeper.com/b/HY6M6) is deobfuscated via hex decoding in an hl[] array. The data object is in scope for all dynamically-executed payloads and is exfiltrated by the fetched stage-2 code.