GCVE-110-OSM-2026-5122

Exfiltrates system identity and CI environment variables to an attacker-controlled Cloudflare Workers endpoint when invoked via `npx cosmosdb-server`. Collects hostname, username, working directory, home directory, platform, architecture, memory, local IPv4 addresses, and CI tokens including GITHUB_ACTIONS, GITHUB_REPOSITORY, GITHUB_ACTOR, and VERCEL, then POSTs the payload as JSON to https://callback-monitor.cyb3rsh4ykh.workers.dev/c. Impersonates the legitimate @vercel/cosmosdb-server package. **Trigger**: bin entrypoint — exfiltration fires when the user runs `npx cosmosdb-server`; no install hook is present. **Collection (system info)**: reads `os.hostname()`, `os.userInfo().username`, `process.cwd()`, `os.homedir()`, `os.platform()`, `os.arch()`, `process.version`, `os.cpus().length`, `os.totalmem()`, `os.uptime()`, and `os.networkInterfaces()` IPv4 addresses. **Collection (CI env vars)**: reads `process.env.GITHUB_ACTIONS`, `process.env.GITHUB_REPOSITORY`, `process.env.GITHUB_ACTOR`, `process.env.VERCEL`, `process.env.VERCEL_ENV`, `process.env.GITLAB_CI`, `process.env.JENKINS_URL`, `process.env.CIRCLECI`, `process.env.CI`, `process.env.CONTINUOUS_INTEGRATION`. **Encoding**: all collected data serialized as JSON. **Exfiltration**: POSTs to literal constant `CALLBACK_URL = 'https://callback-monitor.cyb3rsh4ykh.workers.dev/c'` via `mod.request(CALLBACK_URL)` in `loaders/index.js`.