GCVE-110-OSM-2026-10858

index.js stores a remote URL and a `curl -sL -o` command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply, then fetches and executes the retrieved content at install/import time. Hiding the destination and the download-and-run command behind char-code obfuscation is inconsistent with any legitimate installer or SDK, which references URLs in plain form. The reconstructed shell invocation downloads an attacker-controlled payload to disk and runs it on the installer's machine, giving whoever published the package arbitrary code execution on any host that installs it.