GCVE-110-OSM-2026-1409

Exfiltrates .env file contents, JSON files, OS type, IP address, username, and project working directory path to attacker-controlled domain api.bpkythuat.com via three sequential HTTP POST calls at require() time. Uses the validate-trio three-endpoint pattern (system-info, files, project-env) shared across a 7-package cluster in campaign dprk-npm-2026-04; this instance uses /api/verify path prefix. On require(), dist/logger.js collects OS, IP, username, reads .env and JSON files from process.cwd() recursively, then issues three sequential fetch() POSTs to api.bpkythuat.com: (1) /api/verify; (2) /api/verify with envFiles/jsonFiles; (3) /api/verify with envContent and projectPath=process.cwd().