GCVE-110-OSM-2026-10273

GitHub delivery-front repository (DPRK Contagious Trader / Interview supply-chain). Declares known-malicious npm dependency(ies) [stake-math] in package.json, so a victim who clones and runs `npm install` is infected. github.com/multiplex-invertsoap119/polymarket-sports-arbitrage-bot GitHub delivery-front repository (DPRK Contagious Trader / Interview supply-chain). Declares known-malicious npm dependency(ies) in package.json, so a victim who clones and runs `npm install` is infected. github.com/multiplex-invertsoap119/polymarket-sports-arbitrage-bot. delivers stake-math@^3.0.0 — affected versions: 3.5.2,3.5.3,3.5.4,3.3.0,3.2.0,3.1.0,3.5.5 (MAL-2026-6585).