GCVE-110-OSM-2026-10135

This is a minimal HTTP file server package (fsbrowse) with a well-established publisher (261 packages, zero prior malicious packages). The flagged findings are all false positives in test files: `encodeURIComponent` is standard URL encoding for file paths in an HTTP file server, `new Function('return ' + ...)` in test files is a common pattern for evaluating JSON-like expressions in test assertions, and POST method usage is straightforward HTTP API testing. The 'corporate-targeting' rule fired on test function names like `testMkdirTraversal` and `testServerBasepathEnv`, which are clearly security-oriented test cases verifying path traversal protections. The only IOC is `http://localhost:3000`, a test endpoint. The entrypoint (`bin.js`) is clean CLI argument parsing with no network calls, and there is no exfil path, no obfuscation, and no suspicious IOCs. ENTRY bin.js (bin: bin.js) EXFIL - Corporate Environment Targeting in test-extended.js: "tMoveAllErrors(); await testMkdirTraversal(); await testServerBasepathEnv(); awa..." - Corporate Environment Targeting in test-final.js: "tMoveInvalidPath(); await testFactoryNullOpts(); await test" - Data Encoding for Exfiltration in public/app.js: "encodeURIComponent(file.path" - Data Encoding for Exfiltration in test-final.js: "encodeURIComponent('spaces in name.txt" ADDITIONAL FINDINGS - Dynamic Code Execution in test-extended.js: "new Function('return ' +" PAYLOAD FILES test-extended.js (+ test-final.js)