GCVE-110-OSM-2026-10604

One of several dozen malicious npm packages published in a coordinated scripted session on August 16, 2026, targeting six popular JavaScript libraries by name using typos, transpositions, and plausible `-core`/`-lib`/`-cli` suffixes. All packages share identical functional code, confirming a single operator. Executes at install time via `postinstall` hook — no import required. Windows-targeted infostealer; Linux/macOS receive telemetry only. The XOR key (`stf2026`), Rust loader fingerprint, and `gofile[.]io` exfiltration pattern overlap with the StubMaker campaign — this is likely the same threat actor. See https://opensourcemalware.com/?search=%23stubmaker for related OSM records.