GCVE-110-OSM-2026-5855

Exfiltrates AWS IMDS credentials, AWS SecretsManager values, npmrc credentials, and environment variables matching HTB|FLAG|SECRET to attacker-controlled endpoint 154.57.164.71:30782 via HTTP PUT in the postinstall hook. Targets hosts with 12-character hex hostnames in /home/node or /app directories. **Trigger** (postinstall): executes `node postinstall.js` at install time. **Collection**: spawns `/bin/sh` to query AWS IMDSv2 (169.254.169.254) for IAM role and security credentials, enumerates AWS SecretsManager across us-east-1, eu-west-1, and eu-central-1, reads `/root/.npmrc`, and greps environment variables for `HTB|FLAG|SECRET` patterns. **Exfiltration**: HTTP PUT to `http://154.57.164.71:30782/api/modules/ECT-472839` and `http://154.57.164.71:30782/api/modules/ECT-987654` (also relayed through `http://127.0.0.1:30782/api/modules/ECT-472839` and `http://127.0.0.1:30782/api/modules/ECT-987654`). **Stage chain**: fetches JSON module descriptors from the same C2 endpoints; chain terminates at these config endpoints.