GCVE-110-OSM-2026-11119

This looks like a likely burner/throwaway package used as a security-holding or staging asset rather than a normal library: the publisher account is extremely new, has 24 randomly named packages, and the package itself has no repository while being published under a generic holding description. The entrypoint is an `index.html` that is essentially a Cloudflare Turnstile challenge page, which is unusual for an npm package and suggests the real payload may be hidden behind a verification gate or delivery mechanism. The `string-array-obfuscation` finding in `index.html` adds to the concern even though no exfiltration was recovered; taken together, this is consistent with a staged loader or test artifact by an unknown attacker model rather than benign package code. ENTRY index.html (main: index.html) OBFUSCATION - String Array Obfuscation in index.html: "['qxzKv3e','ugvYz1G','ANztDLm','Cwnvzhu','Bg9JyxrPB24','CM9HvKe','C2vHCMnOugfYyq..." ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern