GCVE-110-OSM-2026-10236

This looks more like a burner-account / dependency-confusion style package than a clearly weaponized implant: the publisher is brand-new, has a burner-pattern history of near-duplicate names, and the package name `bs58-12` closely tracks the legitimate `bs58` ecosystem. The entrypoint `src/cjs/index.cjs` is just a thin wrapper around `base65-12x` that returns a Base58 alphabet encoder, which is plausible for a legit utility, but the IOC `16UjcYNBG9GTK4uq2f7yYEbuifqCzoLMGS` is classified as exfil and the presence of `cdn.rawgit.com` suggests legacy remote-content dependence. Because there is no direct code showing credential theft or network exfiltration, I cannot call it malicious, but the metadata and IOC combination is suspicious enough to warrant review by a supply-chain attacker model. ENTRY src/cjs/index.cjs (main: src/cjs/index.cjs) DESTINATION - 1 exfil (bitcoinAddresses) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern