Coordinated npm infostealer campaign. Multiple packages published with embedded reconnaissance/infostealer code that harvests machine identity, git/GitHub credentials, SSH key metadata, and cloud (GCP/AWS) configuration and exfiltrates it via HTTPS to Cloud Run endpoints disguised as telemetry. Packages shared a single GCP project (228835561205) and byte-identical payloads. All were removed from the npm registry by the npm security team (replaced with 0.0.1-security holding placeholders; argon2-napi hard-unpublished). All versions affected.