GCVE-110-OSM-2026-4700

Exfiltrates AWS IAM session tokens, Azure management OAuth2 tokens, and GCP service account tokens by querying cloud metadata services at install time, along with 36 CI/CD environment variables spanning GitHub Actions, GitLab CI, Azure DevOps, Jenkins, CircleCI, and 10 other platforms, plus victim project metadata and internal network DNS probe results — all transmitted as chunked HTTPS GET requests to the attacker-controlled Cloudflare Workers endpoint openmrs-sol-dev-v2.lapxa354.workers.dev. The cloud metadata service IP is encoded as decimal integer 2852039166 in source to evade detection. Execution fires silently at both preinstall and postinstall with a 60-second delay; a build-tool proxy is forked as cover. **Trigger** (`preinstall` and `postinstall`): both hooks execute `node index.js` at install time. A 60-second `setTimeout` delay precedes payload execution. **Cloud credential theft**: queries AWS, Azure, and GCP cloud metadata services for IAM role name and session token, VM instance metadata and management OAuth2 token, and GCP service account access token respectively. The cloud metadata IP address is stored as the decimal integer `2852039166` in source to evade naive string matching. AWS IMDSv1 fallback also present. **CI/CD reconnaissance**: reads 36 named environment variables across GitHub Actions (`GITHUB_TOKEN`, `GITHUB_REPOSITORY`, `GITHUB_ACTOR`), GitLab CI, Bitbucket, Azure DevOps, Jenkins, CircleCI, Buildkite, Travis CI, Vercel, Heroku, Render, Fly.io, Drone, and Semaphore. **Filesystem access**: walks up to 6 directory levels to find victim project `package.json`; reads project-level and home-level `.npmrc`; enumerates presence of `~/.ssh/id_rsa`, `~/.gitconfig`, `~/.bash_history`, `~/.kube/config`, `~/.aws/credentials`, Docker socket, VSCode config, cargo, npm, and ngrok binaries. **System fingerprinting**: collects hostname, username, architecture, working directory path, uptime, local network interfaces, DNS search domain, process count, git HEAD ref, UID/GID, and git global user email. **Internal network mapping**: DNS-probes 25 internal domains including `kubernetes.default.svc.cluster.local`, `vault.internal`, `consul.service.consul`, `gitlab.internal`, `redis.internal`, `db.internal`, and `ec2.internal`. **Exfiltration**: entire payload serialised to JSON, base64url-encoded, split into 45-character chunks, and transmitted as sequential HTTPS GET requests to `https://openmrs-sol-dev-v2.lapxa354.workers.dev` with 250ms inter-chunk delay. User-Agent: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) MalekAbuLialaResearch/1.0`. C2 hostname stored as base64 literal in source. **Cover**: forks first available build tool (`webpack-cli`, `vite`, `rollup`, `turbopack`) from `node_modules` to masquerade as a legitimate build wrapper.