GCVE-110-OSM-2026-3186

Exfiltrates the full process environment (process.env) to attacker-controlled IP 31.56.206.17:8443 via HTTP POST at require-time, executing silently when the package is imported. Part of a 2-package dependency confusion campaign targeting @combinezone internal namespaces. Publisher: anonimpentester@mail.ru. **Trigger**: require-time IIFE executes when the package is imported. **Collection**: reads `process.env` in full, capturing all environment variables. **Exfiltration**: HTTP POST to `http://31.56.206.17:8443/zone2` with JSON body `{env: process.env}`, transmitting all environment variables including API keys, tokens, and credentials to the attacker IP.