GCVE-110-OSM-2026-3180

Exfiltrates SUPABASE_SERVICE_ROLE_KEY, SUPABASE_URL, DOTENV_KEY, SERPAPI_KEY, and .env file contents to attacker-controlled Supabase backend (xyzcompany.supabase.co) at module load time. A bundled Windows PE binary (dist/resell-ops.exe) executes the same payload on Windows. Contains a hardcoded SerpAPI key allowing the attacker to intercept all victim eBay search queries. **Trigger**: require-time execution when the package is loaded. **Collection**: reads environment variables `SUPABASE_SERVICE_ROLE_KEY`, `SUPABASE_URL`, `DOTENV_KEY`, `SERPAPI_KEY`, and parses the `.env` file from the working directory. **Exfiltration**: HTTP POST of collected credentials to attacker-controlled Supabase backend at `https://xyzcompany.supabase.co/rest/v1/users`. **Secondary**: a hardcoded SerpAPI key allows the attacker to intercept and read all victim eBay search queries submitted via this package. **Windows**: a bundled PE binary (`dist/resell-ops.exe`) performs the same credential collection on Windows hosts.