GCVE-110-OSM-2026-6279

Steals credentials, crypto wallet keys, shell history, and Telegram Desktop sessions at install-time via postinstall hook (node test.js). Four sequential exfil operations target: (1) platform-wide recursive scan of all home directories (Linux/macOS) or drive letters C-J (Windows) for .env files, Solana id.json keypairs, config.toml, and wallet/credential-keyword documents; (2) CWD scan for the same targets; (3) shell history from bash, zsh, fish, sh, and PowerShell with subprocess fallback invocations; (4) Telegram Desktop tdata directory packed into a custom gzip archive and uploaded (Windows/macOS only). All data exfiltrated via multipart POST to a Vercel-hosted C2 endpoint shared with mjs-eslint-helper. Postinstall hook executes node test.js which calls exported from_str orchestrator in index.js, invoking from_str_2 (platform scan), from_str_1 (CWD scan), from_str_3 (shell history), from_str_4 (Telegram tdata) in sequence. Platform scan batches files at 4MB with 200ms inter-batch delay. Shell history falls back to subprocess invocations (bash -c history, zsh -c 'fc -l -1000') when history files are absent. Telegram tdata uses custom 4-byte-framed gzip packing and dedup marker in tmpdir to avoid re-exfil. C2 URL configurable via BACKUP_API_URL env var. No obfuscation detected.