GCVE-110-OSM-2026-3176

Harvests developer credentials by presenting a fake software piracy/license prompt. Victims who enter credentials have them exfiltrated to attacker-controlled endpoint heroui-pro-proxy.2475096613.workers.dev. Masquerades as a legitimate HeroUI Pro setup utility. **Trigger**: require-time execution when the package is loaded. **Lure**: presents a fake HeroUI Pro license/software piracy dialog to the developer, prompting them to enter credentials (license key or account credentials). **Exfiltration**: submits entered credentials via HTTP POST to `https://heroui-pro-proxy.2475096613.workers.dev`. **Mechanism**: social engineering — requires active victim input; does not harvest credentials silently from environment.