GCVE-110-OSM-2026-10518

This looks like a reverse-shell or payload-delivery package published by a burner npm account, not a legitimate library: the operational URL points to an ngrok-free.dev tunnel and the static analyzer explicitly matched the reverse-shell setup combo. The package.json contains a postinstall node -e hook, which is a common persistence/execution vector for pulling and running remote code during installation. Given the brand-new publisher identity, minimal metadata, and fetched-payload IOC. The most plausible attacker model is a supply-chain delivery implant intended to execute a remote payload on install. ENTRY - Postinstall Script in package.json: ""postinstall": "node -e \"" DESTINATION - 2 fetched-payload (urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Ngrok Tunneling Service in package.json: "ngrok-free.dev" - Brand New Package - Very New NPM Publisher Account