GCVE-110-OSM-2026-10603

This package appears to be a low-capability nuisance/troll package rather than a sophisticated exfiltration tool. The entrypoint file 'H4ckEd/r222222222222.js' exports a function with a deliberately provocative name referencing 'death_of_father' and embedding a Telegram group link (t.me/anoncrews), but the function body only calls console.log with a null byte — no actual exfiltration or execution of remote code is present. The package name, directory structure ('H4ckEd'), keyword 'Hackers', Telegram IOC, and pngup.com domain suggest affiliation with a hacker group advertising their channel, which is a common pattern for low-effort defacement or brand packages that may escalate in future versions. The brand-new account (under 2 days old), disposable email (ittiv.com), and zero downloads reduce the immediate risk but warrant monitoring. ENTRY H4ckEd/r222222222222.js (main: ./H4ckEd/r222222222222.js) ADDITIONAL FINDINGS - Very New NPM Publisher Account