GCVE-110-OSM-2026-2606

Exfiltrates corporate environment variables (JET_, SKIP_, COURIER_, DOORDASH_, UBEREATS_, CI/CD tokens including GITLAB_, JENKINS_, GITHUB_, BUILDKITE_), git remote URLs filtered for corporate keywords, network interface IPs, hostname, platform, architecture, and nearby package.json contents via HTTPS POST to phish.sh webhook endpoint. Dependency confusion attack targeting the @jet-react-native scope with version 99.99.100 designed to override private registry packages. **Trigger** (`postinstall`): executes `node beacon.js` at install time. **Collection**: harvests environment variables matching corporate patterns (JET_, SKIP_, COURIER_, DOORDASH_, UBEREATS_) and CI/CD patterns (CI_, BUILD_, GITLAB_, JENKINS_, GITHUB_, BUILDKITE_, NODE_ENV, REACT_NATIVE_, METRO_, ANDROID_, XCODE_). Runs `execSync` to enumerate build tools (gradle, xcodebuild, react-native, metro, yarn, npm, pod) and git remotes filtered for corporate keywords (jet, skip, courier, doordash, delivery). Collects hostname, platform, arch, cwd, PID, memory usage, network interface IPs, and nearby package.json files. **Scoring**: implements a JET likelihood scoring algorithm to assess whether the installation occurred in a legitimate JET developer environment. **Exfiltration**: POSTs all collected data to `https://phish.sh/webhook/a8f3e7c2-9d1b-4c56-8e2f-7a3b9c5d4e1f.php`. The index.js module also fires beacons on every require() and method call.