GCVE-110-OSM-2026-11120

This looks like a security-holding or burner package rather than a clearly malicious payload, but the publisher metadata is highly abnormal: account age is effectively zero, the user has 24 packages with random-looking names, and the package text itself says "security holding package." The entrypoint is a Cloudflare challenge page in `index.html`, which is unusual packaging for npm and suggests the content may be a placeholder or cover page rather than a normal library. There are no recovered IOCs or exfiltration paths, so I cannot prove an attacker goal, but the burner-account pattern plus obfuscated string arrays makes this worth manual review. ENTRY index.html (main: index.html) OBFUSCATION - String Array Obfuscation in index.html: "['yMLUza','s09Hzwe','CMvWBgfJzq','y3rVCIGICMv0Dq','CM4GDgHPCYiPka','E30Uy29UC3rY..." ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern