GCVE-110-OSM-2026-11121

This looks like a security-holding or disguise package published from a likely burner account, but the package identity and metadata are strongly suspicious enough to warrant review. The `mnmobicom` package is one of 24 random-looking packages from `henryp52uflores`, an account flagged by `new-npm-account-week` and `publisher-burner-pattern`, which is a common attacker model for mass-seeding or dependency confusion. The entrypoint `index.html` is a Cloudflare challenge page, and the recovered `string-array-obfuscation` in that file suggests intentional concealment even though no exfil IOCs were recovered. I do not see a concrete payload or attacker objective beyond masquerading content, so I would not call it confirmed malware, but it is too suspicious to suppress submission. ENTRY index.html (main: index.html) OBFUSCATION - String Array Obfuscation in index.html: "['y3rVCIGICMv0Dq','y29UC3rYDwn0BW','D2fYBG','s01mELC','zxjYB3i','AwruD08','DNvJA..." ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern