GCVE-110-OSM-2026-1493

Injects attacker's SSH public key into ~/.ssh/authorized_keys and exfiltrates victim IP, username, and hostname to attacker-controlled Supabase storage (ndfcioahsbgsjmulpjgt.supabase.co) during postinstall. Installs a repeating 60-second job for persistent key re-injection. postinstall executes setup.js which: (1) downloads attacker's SSH public key from Supabase storage at ndfcioahsbgsjmulpjgt.supabase.co/storage/v1/object/project_bucket/public_keys/main.pem.pub; (2) injects the key into ~/.ssh/authorized_keys tagged as 'ssh-key-auto-sync'; (3) exfiltrates victim IP, username, and hostname as a text file to the same Supabase bucket at logs/{ip}_{hostname}.txt. index.js schedules this job to repeat every 60 seconds.