GCVE-110-OSM-2026-4756

Exfiltrates npm tokens, AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), CI tokens, Artifactory/Nexus tokens, and .npmrc credential file contents to attacker-controlled infrastructure at oob.moika.tech via HTTPS POST during postinstall. Downloads and silently executes an OS-specific second-stage binary (macOS/Windows/Linux) from https://oob.moika.tech/payload as a detached background process that persists beyond npm install completion. Part of the bcs-bank cluster sharing C2 infrastructure with @databus-service-ui/ui-event. **Trigger** (`postinstall`): executes `node scripts/postinstall.js` at install time via package.json postinstall hook. **Collection**: reads environment variables — `npm_token`, `npm_config_authtoken`, `npm_config__auth`, `node_auth_token`, `github_token`, `aws_access_key_id`, `aws_secret_access_key`, `aws_session_token`, `artifactory_token`, `nexus_token`, `npm_config_registry`, `ci`, `github_actions` — from `process.env`. Reads `~/.npmrc`, `/etc/npmrc`, `<cwd>/.npmrc`, and `<cwd>/../.npmrc` via `fs.readFileSync`. Collects hostname, username, platform, arch, os_release, cwd, node_version, npm_version, npm registry config, and CI flags. **Exfiltration**: POSTs collected system fingerprint to `https://oob.moika.tech/report` with hardcoded `X-Secret: l95HdDaz3kQx1Zsg3WxH6HvKANf51RY1` authentication header. **Second-stage delivery**: GETs OS-specific payload from `https://oob.moika.tech/payload` with OS-type path suffix, authenticated with the same X-Secret header. Writes payload to `os.tmpdir()` as `._service-suppliers_init.sh` (Unix) or `._service-suppliers_init.bat` (Windows). **Execution**: executes payload via `spawn('/bin/sh', [tmp], {detached:true, stdio:'ignore'}).unref()` on Unix or `spawn('cmd.exe', ['/c', tmp], {detached:true, windowsHide:true}).unref()` on Windows — detached and unreferenced, surviving npm process exit. **Persistence**: writes telemetry JSON to `~/.service-suppliers_telemetry.json`. **Version selection**: 9.9.10 chosen to win dependency confusion races in environments pinned to lower private registry versions.