GCVE-110-OSM-2026-2604

Exfiltrates the MY_SECRET_API_KEY environment variable via base64-encoded HTTP header ('stolen-key') in a GET request to digininja.requestcatcher.com during postinstall. A second script performs DNS exfiltration of the same key as a subdomain label to a Collaborator-style endpoint at collab.digi.ninja. Published by a security researcher as a demonstration of postinstall credential theft. **Trigger** (`postinstall`): executes `node ./scripts/setup.js` at install time. **Collection**: reads `process.env.MY_SECRET_API_KEY`. **Encoding**: base64-encodes the API key via `Buffer.from().toString('base64')`. **Exfiltration**: sends a GET request to `https://digininja.requestcatcher.com/` with the base64-encoded key in a custom `stolen-key` HTTP header. **Secondary channel** (not hooked to postinstall): `scripts/dns_callback.js` performs `dns.lookup(apiKey + '.6u1s7jd9esbax66anvpcg34jgam1asyh.collab.digi.ninja')` — DNS exfiltration of the API key as a subdomain label.