GCVE-110-OSM-2026-3247

Steals AWS IAM credentials, Docker registry passwords, npm/yarn/pnpm auth tokens, GitHub CLI tokens, and all environment variables at install time via a preinstall hook. Exfiltrates all harvested data base64-encoded via HTTP GET to a victim-specific subdomain on moika.tech. Targets developer workstations and CI/CD pipelines. Published under the actor's own @m0ntana npm scope 34 minutes before sibling brand-impersonation packages targeting Tochka Bank, Sberbank GitVerse, and Alfa Life. Preinstall.js harvests ~/.aws/credentials, ~/.aws/config, ~/.docker/config.json (base64-decoded to plaintext), ~/.config/gh/hosts.yml (GitHub CLI oauth_token), .npmrc, .yarnrc, .netrc, .gitconfig, .pypirc, gradle.properties, .cargo/credentials, pip.conf, full process.env, and 17 .env file variants across 4 parent directory levels. All data is base64-encoded and exfiltrated via HTTP GET to http://app-web.m0ntana.{os}-{user}.{hostname}.moika.tech/env?d={base64}.