GCVE-110-OSM-2026-5949

Exfiltrates sensitive environment variables including API keys, tokens, credentials, and SSH private keys to attacker-controlled server 185.130.46.35:8443/collect via HTTPS POST during preinstall. Version 999.0.0 is a dependency confusion attack targeting private registries. **Trigger** (preinstall): executes `node postinstall.js || true` at install time — the `|| true` ensures npm install succeeds silently even if exfiltration fails. **Collection**: reads hostname (`os.hostname()`), username (`os.userInfo().username`), current working directory (`process.cwd()`), and filters `process.env` for keys matching `/key|secret|token|pass|private|ssh|deploy|auth|api|rpc|wallet|sentry|docker|graph|slack|host/i`, also reads `npm_config_registry` and `npm_config_prefix`. **Encoding**: collected data is serialized with `JSON.stringify()`. **Exfiltration**: POSTs the JSON payload to `https://185.130.46.35:8443/collect` via `https.request()`.