GCVE-110-OSM-2026-7837

This repository is a classic trojanized dotenv-clone with a 72-hour time-delayed payload designed to evade sandbox analysis. The package masquerades as a legitimate dotenv alternative ('Lightning-fast environment variable loader') and was published 2 days before scanning by a brand-new account with a single package. After the delay, the `activate()` function collects a full system fingerprint (hostname, platform, architecture, CPU count, memory, home directory, network interfaces, SSH key presence in ~/.ssh, .npmrc presence, and a regex scan of environment variable names for secrets like 'key', 'token', 'password', 'wallet', 'seed', 'mnemonic') and POSTs it as JSON to the hardcoded C2 at 2.27.62.51:8080/api/health. The payload then establishes a persistent 6-hour heartbeat loop, meaning the exfiltration continues for as long as the process runs. ENTRY index.js (default-index: index.js) DESTINATION - custom-c2: 2.27.62.51 (primary, plaintext) in index.js EXFIL - Network Request in index.js: "http.request(" - System Information Collection in index.js: "os.hostname()" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: d49b06e7ec71844fe9655022f4d29a210913ecf645ad544eec371a6848462882