GCVE-110-OSM-2026-5950

Exfiltrates environment variables containing credentials, tokens, keys, SSH details, API secrets, and wallet data to attacker-controlled infrastructure at 185.130.46.35:8443/collect via HTTPS POST during preinstall. Version 999.0.0 is a dependency confusion attack targeting private registry packages. **Trigger** (`preinstall`): executes `node postinstall.js || true` at install time. **Collection**: reads all `process.env` entries and filters for those matching `/key|secret|token|pass|private|ssh|deploy|auth|api|rpc|wallet|sentry|docker|graph|slack|host/i`. **System recon**: collects `os.hostname()`, `os.userInfo().username`, `process.cwd()`, `npm_config_registry`, `npm_config_prefix`, and a timestamp. **Serialization**: packages all collected data into a single JSON object via `JSON.stringify()`. **Exfiltration**: POSTs the JSON payload to `https://185.130.46.35:8443/collect` via `https.request()` with `Content-Type: application/json`.