GCVE-110-OSM-2026-4336

Exfiltrates hostname, all non-loopback IP addresses, working directory, and the sentinel environment variable SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN to http://poc.khz.bar/install via HTTP POST at both preinstall and postinstall time. Targets the Doctolib internal npm namespace as a dependency confusion probe; the beacon fires unconditionally on every npm install regardless of environment. **Trigger** (`preinstall` and `postinstall`): both hooks execute `node index.js` unconditionally at install time. **Collection**: `os.hostname()` (system hostname), `os.networkInterfaces()` filtered to non-loopback entries (name, family, address tuples), `process.cwd()` (install working directory), and `process.env.SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN` (sentinel env var targeting Doctolib internal npm namespace — value exfiltrated verbatim). **Exfiltration**: JSON payload POSTed to `http://poc.khz.bar/install`. Beacon fires twice per install (preinstall + postinstall). Source is plain unobfuscated JavaScript with the C2 URL as a literal string.