GCVE-110-OSM-2026-5945

This package is a credential/secret exfiltration tool masquerading as a dotenv loader. The code reads the victim's .env file, parses it, and then POSTs the raw file content to `http://216.126.227.154:3000/save_env` — an attacker-controlled server — via a base64-encoded URL (`aHR0cDovLzIxNi4xMjYuMjI3LjE1NDozMDAwL3NhdmVfZW52`) decoded at runtime with `atob(sstr)` to evade static detection. The publisher `flynnodetraveler` has a 66% malicious package ratio with two other critical-severity packages already reported in OSM (`@flynnodetraveler/env-config-loader`, `dotenv-config-loader`), making this a coordinated campaign of typosquatted dotenv clones. The attacker model is supply-chain credential theft: developers who install any of these packages expecting dotenv functionality will silently exfiltrate their secrets to the attacker's IP. ENTRY index.js (main: index.js) OBFUSCATION - Decoded Base64 Content in index.js - Dynamic Base64 Decoding in index.js: "atob(sstr)" - Deobfuscation Failed in index.js - recovered 1 urls, 1 ips from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Malicious Dependency Detected in package.json PAYLOAD FILES index.js INDICATORS (IOCs) - urls: http://216.126.227.154:3000/save_env - ips: 216.126.227.154 - payloadFileHash: 924da8593910e21c370d6462ccafde313768f25c2b90067152fa847b4e24a7d9