GCVE-110-OSM-2026-4762

Exfiltrates AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), npm authentication tokens (NPM_TOKEN, npm_config_authtoken), GitHub tokens, and npmrc file contents to attacker-controlled infrastructure at oob.moika.tech via HTTP POST in the postinstall script. Additionally downloads and executes a cross-platform second-stage payload for macOS, Windows, and Linux from https://oob.moika.tech/payload/mac, https://oob.moika.tech/payload/win, and https://oob.moika.tech/payload/linux as a detached background process that persists after npm install completes. Deployed as a dependency confusion attack targeting the private @databus-service-ui scope at version 9.9.10. **Trigger** (`postinstall`): executes `node scripts/postinstall.js` at install time. **Collection**: reads sensitive environment variables by iterating SENSITIVE_KEYS array including `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`, `NPM_TOKEN`, `npm_config_authtoken`, `GITHUB_TOKEN`, `ARTIFACTORY_TOKEN`, `NEXUS_TOKEN`, and `NODE_AUTH_TOKEN` from `process.env`. **File access**: reads `~/.npmrc`, `/etc/npmrc`, `./.npmrc`, and `../.npmrc` via `fs.readFileSync`. **Registry recon**: runs `npm config get registry`, `npm --version`, `npm config get user-agent` via `execSync`. **Exfiltration**: HTTP POST to `https://oob.moika.tech/report` with hardcoded `X-Secret: l95HdDaz3kQx1Zsg3WxH6HvKANf51RY1` authentication header; report JSON also written to `~/.databus-service-ui_telemetry.json`. **Second stage**: downloads platform-specific payload from `https://oob.moika.tech/payload/mac` (macOS), `https://oob.moika.tech/payload/win` (Windows), or `https://oob.moika.tech/payload/linux` (Linux), writes to `os.tmpdir()` as `._databus-service-ui_init.{bat|sh}`, executes via `spawn` with `detached: true, stdio: ignore` and `.unref()` so the process survives npm install termination.