GCVE-110-OSM-2026-10224

The publisher 'tiltwork' has a publisherMaliciousRatio of 1.0, meaning every other package they've published (bcs-compact) is already flagged as critical malware in OSM. This package directly depends on that known-malicious package 'bcs-compact' and calls its exported function `uleb128Decode` in index.js — making it a delivery vehicle for whatever payload bcs-compact carries. The package account was created less than a day ago, has no source repository, and published two versions in rapid succession, all hallmarks of a throwaway attacker account. The surface code in index.js is plausible-looking boilerplate (a GraphQL client for Sui) designed to appear legitimate while the actual malicious behavior is proxied through the bcs-compact dependency. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Malicious Dependency Detected (OSM) in package.json - Brand New Package - Very New NPM Publisher Account - Publisher Has Other Malicious Packages - Rapid Version Publishing - Malicious Dependency Detected in package.json