GCVE-110-OSM-2026-4197

Steals browser credentials, crypto wallet keys, seed phrases, npm tokens, and API credentials at install time via a postinstall hook, exfiltrating all collected data via HTTP POST to attacker-controlled C2 at 149.28.127.35:8888. The package typosquats `rimraf` and deploys a multi-vector harvester targeting Chrome, Brave, Edge, and Firefox credential databases, 71 browser extension wallet IDs, BIP-39 seed phrase files, EVM private keys, and developer credential files (~/.npmrc, ~/.env, ~/.git-credentials). A decoy index.js stub comments 'The real payload is in postinstall.js'; the C2 infrastructure is shared across at least three sibling typosquat packages in the same campaign. **Trigger** (`postinstall`): `package.json` defines `postinstall: node postinstall.js`; executes immediately on `npm install` without user interaction. **Collection — browser credentials**: `stealBrowserDBs()` reads Chrome, Brave, Edge Login Data SQLite databases, Cookies, and Web Data files, plus Firefox `logins.json`, across Linux and Windows filesystem paths. **Collection — crypto wallets**: `scanWallets()` iterates 71 browser extension IDs under Chrome/Brave/Edge Local Extension Settings, extracting vault, keyring, mnemonic, seed, and privateKey fields from `.log` files. **Collection — seed phrase files**: `scanSeeds()` recursively searches Documents, Desktop, Downloads, OneDrive, Dropbox, and crypto-named directories for files matching seed|backup|wallet|phrase|crypto|metamask|phantom|vault|key|private|mnemonic|recover|keystore; applies BIP-39 word threshold (>=8 matches) and EVM private key regex (`0x[a-f0-9]{64}`). **Collection — developer credentials**: `harvest()` reads `~/.npmrc` (npm _authToken, npm_ tokens), `~/.env` (TOKEN/API/DB/PAY/EMAIL keys, EVM private keys), and `~/.git-credentials`. **Exfiltration**: all harvested data is JSON-serialized and sent via `http.request` POST to the hardcoded C2 `http://149.28.127.35:8888` (with `process.env.C2_URL` override fallback).