GCVE-110-OSM-2026-10490

This package is a delivery vehicle for the known-malicious dependency 'kit-hydration-vim', published by the same account ('a_soclav') which has a 100% malicious publisher ratio (1/1 other packages confirmed malicious in OSM). The package was created by a brand-new account (first published the same day) and imports 'kit-hydration-vim' at the entrypoint level, meaning the malicious dependency executes on import. The attacker model is a dependency-chain attack: a plausible-looking analytics wrapper coerces victims into pulling and executing the confirmed-malicious helper. The security holding flag confirms this package has already been flagged for removal. ENTRY dist/index.mjs (main: ./dist/index.mjs) ADDITIONAL FINDINGS - Malicious Dependency Detected (OSM) in package.json - Malicious Dependency Detected in package.json - Brand New Package - Very New NPM Publisher Account - Publisher Has Other Malicious Packages