GCVE-110-OSM-2026-11118

This looks like a burner-account package with no legitimate project metadata, which is a strong publisher-risk signal, but the code itself is mostly a Cloudflare challenge page rather than an overt payload. The entrypoint `index.html` contains a large, copy-like anti-bot page with `challenges.cloudflare.com` and a `data-sitekey`, and the obfuscation finding is only a generic string-array pattern with no recovered IOCs or malware family. An attacker model of throwaway-named npm packages used as deceptive hosting shells or staging artifacts is plausible, but there is no direct exfiltration, credential theft, or execution path visible in the provided content. I would not call this confirmed malicious on the current evidence, but it clearly warrants manual review because of the `publisher-burner-pattern` and `new-npm-account-week` indicators. ENTRY index.html (main: index.html) OBFUSCATION - String Array Obfuscation in index.html: "['mtiWmdiXmgHkthv6qG','D1nSAw0','yMzirxK','C2vHCMnO','vhLctKG','v1jAr3K','DKrtz3..." ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern