GCVE-110-OSM-2026-4189

Steals browser credentials (Chrome, Brave, Edge, Firefox saved passwords and cookies), crypto wallet keys and seed phrases from 71 wallet extension IDs (MetaMask, Phantom, and others), and developer credential files (~/.npmrc, ~/.env, ~/.git-credentials) via HTTP POST in the postinstall script to hardcoded C2 at http://149.28.127.35:8888. Typosquats the glob package; index.js is a decoy stub. C2 is shared with at least four sibling typosquat packages published the same day. **Trigger** (`postinstall`): executes `node postinstall.js` at install time. **Collection — browser credentials**: reads Chrome/Brave/Edge `Login Data` SQLite files and Firefox `logins.json`; base64-encodes first 5KB of each DB; targets Linux (`~/.config/`) and Windows (`%LOCALAPPDATA%`) paths. **Collection — crypto wallets**: scans Local Extension Settings directories for 71 hardcoded wallet extension IDs; extracts `vault`, `mnemonic`, `seed`, `privateKey` values from `.log` files. **Collection — seed phrase files**: scans Documents, Desktop, Downloads, OneDrive, Dropbox, and named directories for files matching `seed|backup|wallet|phrase|crypto|metamask|phantom|vault|key|private|mnemonic|recover|keystore|foundry|hardhat`; detects BIP39 mnemonic words (threshold: 8 matching words), EVM private keys (`0x[a-f0-9]{64}`), and Ethereum keystore format. **Collection — developer credentials**: reads `~/.npmrc` (extracts `_authToken`, `npm_*` tokens), `~/.env` (extracts TOKEN/API/DB/PAY/EMAIL-typed keys and EVM private keys), `~/.git-credentials` (full content). **Exfiltration**: POSTs all collected data as JSON to `http://149.28.127.35:8888` via `http.request` (source literal at `loaders/postinstall.js:7`).