GCVE-110-OSM-2026-11122

This looks like a burner-style npm publisher model: the account is 0 days old, has 24 packages with random-looking names, and the package itself has minimal metadata. The entrypoint is an `index.html` that is essentially a Cloudflare Turnstile challenge page, which is not normal package content and suggests a security-holding or placeholder rather than a real library. The `string-array-obfuscation` finding on `index.html` is a mild but real signal, and the lone IOC `https://lo` is incomplete/low context, so I cannot prove an attacker payload. A plausible attacker model is a throwaway package used for staging, reputation laundering, or hidden content delivery, but the evidence stops short of confirmed malware. ENTRY index.html (main: index.html) OBFUSCATION - String Array Obfuscation in index.html: "['t3vtDee','nJbcAu5bv2u','y29UC3rYDwn0BW','mtm2odm1nLnur0Lyqq','s1DQqwS','Bg9Jyx..." ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern