GCVE-110-OSM-2026-6260

Exfiltrates AWS credentials, GitHub/GitLab/NPM tokens, crypto wallet keys, and filesystem secrets via a postinstall hook. cryptodao-utils v99.99.99 is a dependency confusion attack package published by aduljune@proton.me. The sentinel version 99.99.99 hijacks internal package resolution in CI/CD pipelines; on npm install, recon.js runs unconditionally, harvests 29+ environment variables and reads 13 credential file paths, then POSTs all data as JSON to two OAST endpoints (webhook.site and pipedream). Part of a coordinated multi-package campaign targeting the cryptodao-* internal namespace. recon.js (4065 bytes) is the malicious payload executed via the postinstall hook. It reads environment variables and credential files, aggregates the data into a JSON payload, and POSTs it to https://webhook.site/d6d18927-e513-4df7-b019-58bfc64fe0dd and https://enqoojbegdvxj.x.pipedream.net. A benign index.js stub exports only name and version fields.