GCVE-110-OSM-2026-3246

Exfiltrates all environment variables to attacker-controlled bbhunter.ru infrastructure via a preinstall hook that silently runs at install time. Collects victim username and hostname, encodes them into a unique OAST subdomain on bbhunter.ru, and exfiltrates the full process.env base64-encoded. Published by boris.wh1te@yandex.ru (npm username m0ntana) as a test package 7 minutes before a coordinated dependency confusion campaign targeting Russian financial institution npm scopes. Preinstall.js collects victim username (whoami) and hostname, constructs a unique OAST subdomain (appweb.montanatonytest.{user}.{hostname}.bbhunter.ru), and exfiltrates the full process.env base64-encoded via HTTP GET to /env?d={base64}. Captures all environment variables including cloud credentials and CI/CD secrets.