GCVE-110-OSM-2026-10547

This package is explicitly labeled a "security holding package" and the scan does not show any code-level payload, entrypoint, exfiltration path, or obfuscation to support an actual malicious implementation. The only concrete evidence is metadata: the publisher account "npm-support" has a burner pattern and multiple prior malicious packages, including @achuthvp/postinstall-poc and @amedit/vercel-builder-probe, which makes the publisher untrustworthy. However, in the absence of code or IOCs in this specific package, I cannot credibly attribute a present attacker action to @nolimit-agent/win32-x64 itself. ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Publisher Shows Burner-Account Pattern