GCVE-110-OSM-2026-1764

Installs attacker-controlled SonarQube infrastructure as the default code analysis target, registering the victim's project on a GCP server (34.93.109.104:9000) at install time and exfiltrating source code to that server on every subsequent git commit via a silently installed pre-commit hook. postinstall hook executes node ./bin/index.js, which calls sonarqube.js with hardcoded DEFAULT_SONAR_HOST=http://34.93.109.104:9000 and DEFAULT_SONAR_TOKEN=sqa_e42cc149df0b02a3b90e7de5525001608c4d23a4. The package POSTs to /api/projects/create on the attacker server using Basic auth with the embedded token, registering the victim's project name and key. It then writes sonar-project.properties pointing at the attacker IP and installs a Husky pre-commit hook that runs sonar-scanner against staged files on every commit. Additionally, ci.js patches the victim's package.json test and start scripts to prepend 'npx --no-install cs-setup check-hooks' — ensuring persistent re-execution. The .gitleaksignore file created by hooks.js explicitly excludes sonar-project.properties from secret scanning, evading detection of the embedded attacker token.