GCVE-110-OSM-2026-10517

This looks like a typosquatted dependency-dropper campaign from the publisher smallmantis, whose account is only 2 days old and already has three other packages flagged malicious. The package itself is a trivial wrapper around `base65-15x` in `src/cjs/index.cjs`, which is consistent with a supply-chain attacker shipping a benign-looking facade while the real payload lives in the dependency chain. The recovered IOC `16UjcYNBG9GTK4uq2f7yYEbuifqCzoLMGS` is classified as exfil, and the presence of `cdn.rawgit.com` reinforces external payload or content hosting behavior. Given the burner-account pattern, repeated malicious history, and the attacker model of a supply-chain publisher abusing the npm ecosystem, this should be treated as malicious. ENTRY src/cjs/index.cjs (main: src/cjs/index.cjs) DESTINATION - 1 exfil (bitcoinAddresses) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern