GCVE-110-OSM-2026-10758

The package's main entry index.js imports child_process at the top of the file and invokes spawn("powershell",...) as a top-level side effect (line 27). Loading the module via require/import causes an unprompted PowerShell process to launch on the installer's machine, which is a Windows-focused code execution vector wholly unrelated to any legitimate library function. This is the shape of an install/import-time execution payload rather than an API a caller must opt into. Judge assessment: This is a Windows process-launch payload intended to run arbitrary attacker-controlled commands via the CLI argument, not a legitimate library API. The entrypoint in `index.js` uses `child_process.execSync` to start `powershell`/`cmd` with `-WindowStyle Hidden` and `stdio: "ignore"`, which is classic stealthy execution behavior. The package description, "Launch a hidden Windows cmd from Node.js," matches the implementation exactly, and the combination of a very new publisher account plus rapid version churn suggests an attacker model of a freshly published command launcher or dropper. The OSV advisory also aligns with the code shape, but the verdict is based on the visible `index.js` behavior, not the advisory alone. ENTRY index.js (bin: index.js) ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Very New NPM Publisher Account PAYLOAD FILES index.js