GCVE-110-OSM-2026-5120

Exfiltrates CI/CD environment variables — including GITHUB_ACTIONS, GITHUB_REPOSITORY_OWNER, GITHUB_REPOSITORY, and RUNNER_OS — via HTTPS POST to an attacker-controlled webhook.site endpoint at require-time execution. Impersonates LSP (Language Server Protocol) MCP tooling. Part of a two-package campaign with server-github sharing the same C2 endpoint and publisher. **Trigger**: executes at bin-entrypoint require-time — no install hook; fires when the module is loaded. **Collection**: reads process.env.CI, process.env.GITHUB_ACTIONS, process.env.GITHUB_REPOSITORY_OWNER, process.env.GITHUB_REPOSITORY, process.env.RUNNER_OS, process.version, os.platform(), os.arch(), and Date.now(). **Encoding**: collected values are JSON-serialized. **Exfiltration**: issues an https.request POST to `https://webhook.site/18de28aa-ad1c-447e-b9b2-6e2adbdf864c` (static URL literal in loaders/index.js:23-34).