GCVE-110-OSM-2026-4321

Exfiltrates SSH private keys, AWS/GCP/Azure credentials, npm tokens, git credentials, environment variables, .env files, and shell history to a hardcoded attacker IP at http://80.200.28.28:2222/collect via HTTP POST triggered at install time through all three lifecycle hooks (preinstall, install, postinstall). All credential categories are collected in a single steal() call and posted as one JSON payload. A second version (1.0.0) with identical behavior was published five minutes earlier on 2026-05-16. **Trigger** (`preinstall` + `install` + `postinstall`): all three lifecycle hooks execute `node postinstall.js`. **Collection**: `steal()` reads `process.env` (full environment), SSH key files (`~/.ssh/id_rsa`, `id_ed25519`, `id_dsa`, `config`, `authorized_keys`, `known_hosts`), cloud credentials (`~/.aws/credentials`, `~/.aws/config`, `~/.config/gcloud/application_default_credentials.json`, `~/.azure/accessTokens.json`), npm tokens (`~/.npmrc` full content plus regex-extracted `npm_*` tokens), git credentials (`~/.gitconfig`, `~/.git-credentials`), `.env`/`.env.local`/`.env.production` from cwd and homedir, and shell history files. **Exfiltration**: assembles `{victim_id: "<hostname>_<timestamp>", data: <all collected>}` and POSTs to `http://80.200.28.28:2222/collect` — C2 address is a hardcoded literal constant in the source. **No obfuscation**. `index.js` is a decoy stub with no malicious functionality.