GCVE-110-OSM-2026-4193

Exfiltrates browser saved passwords and cookies (Chrome, Brave, Edge, Firefox), npm auth tokens, git credentials, API keys and EVM private keys from ~/.env, and cryptocurrency wallet seeds from 71 browser extension vaults and local file scans, all via HTTP POST to hardcoded C2 at http://149.28.127.35:8888 during postinstall. Typosquats the dotenv package (publisher: kwakom); the package's index.js is a decoy stub while the infostealer runs silently at install time. **Trigger** (`postinstall`): executes `node postinstall.js` at install time. **Collection**: harvest() gathers os.hostname(), os.userInfo().username, full process.env dump. npmrc harvest reads ~/.npmrc _authToken and npm_[a-zA-Z0-9]{36} tokens. ~/.env harvest extracts TOKEN/API/DB/PAY/EMAIL classified keys and EVM private keys. ~/.git-credentials read directly. **Browser credential theft**: stealBrowserDBs() reads Chrome/Brave/Edge/Firefox Login Data SQLite files (base64-encoded, up to 10MB each) and Firefox logins.json; reads Chrome/Brave/Edge Cookies SQLite files. **Wallet theft**: scanWallets() searches 71 crypto wallet browser extension IDs in Chrome/Brave/Edge Local Extension Settings, extracting vault, data, keyring, mnemonic, seed, and privateKey fields from .log files. **Seed phrase scan**: scanSeeds() recursively searches Documents, Desktop, Downloads, OneDrive, Dropbox, keys, wallet, and crypto directories for files matching seed|backup|wallet|phrase|crypto|metamask|phantom|vault|key|private|mnemonic|recover|keystore|foundry|hardhat patterns; validates BIP-39 word count >=8 or EVM private key regex. **Exfiltration**: single HTTP POST of JSON-serialized harvest object to `http://149.28.127.35:8888` (literal at loaders/postinstall.js:7). No obfuscation; source is fully plaintext.