GCVE-110-OSM-2026-10348

This package explicitly depends on 'kit-map-vim', which is confirmed malicious by two separate knownMalware findings citing 'Malicious code in kit-map-vim' and 'Malware in kit-map-vim'. The package's own description is 'security holding package', indicating it was registered to block a name after a malicious campaign — but the malicious dependency is still declared in package.json and the entrypoint actively imports from 'kit-map-vim' at runtime ('import { bucketByDay, qualifyingDayKeys } from kit-map-vim'), meaning any consumer installing this version would pull in and execute the known-malicious helper. The package was created only 5 hours ago, has no repository, and no author attribution — consistent with a hastily assembled supply-chain attack vehicle. The attacker model is dependency-chain poisoning: a plausible-sounding Svelte/SvelteKit utility that launders malicious execution through a seemingly innocuous calendar-math helper. ENTRY dist/index.mjs (main: ./dist/index.mjs) ADDITIONAL FINDINGS - Malicious Dependency Detected in package.json - Brand New Package