GCVE-110-OSM-2026-10392

package.json declares a postinstall script that runs `node -e` to invoke fs.writeFileSync, creating /tmp/PWN_R3REAL/FIRED on the installer's machine when the package is installed. The package's main module only exports the literal value 42 and ships no native build or legitimate reason for install-time execution; the postinstall exists solely to demonstrate arbitrary code execution on the installer host at `npm install` time. The behavior fires automatically on default install and writes to a path outside the package directory, matching the shape of a proof-of-execution beacon. The package name and description self-identify as an authorized security test, but self-labeling is not a mitigation and the code path is functionally identical to a dropper marker. Judge assessment: The package self-identifies as an authorized security test in both its description and deprecation notice, consistent with a bug bounty or dependency confusion proof-of-concept. The OSV advisory (MAL-2026-13989) confirms the postinstall script uses `node -e` to write a marker file at /tmp/PWN_R3REAL/FIRED, which is a classic proof-of-execution beacon rather than a credential-stealing or exfiltration payload. The entrypoint (index.js) exports only the literal 42 with no malicious logic, corroborating the test-artifact characterization. While the code path is functionally equivalent to a dropper marker, the self-labeling, deprecation warning, and absence of any exfiltration, obfuscation, or network callbacks all support a security test rather than an adversarial campaign — though self-labeling alone is not a mitigation. ENTRY index.js (main: index.js) - Postinstall Script in package.json: ""postinstall": "node -e \""