GCVE-110-OSM-2026-11125

This looks like a burner-package dropper or placeholder with strong metadata red flags: a brand-new npm account, 24 random-looking packages, and no meaningful repository or description. The entrypoint is `index.html`, which is not a normal npm runtime artifact and serves a Cloudflare challenge page, but the presence of `string-array-obfuscation` in the same file suggests concealed logic rather than a legitimate static asset. I do not see recovered exfiltration IOCs or a confirmed malware family, so I cannot call it definitively malicious, but the publisher pattern is consistent with a throwaway attacker model used to seed or stage suspicious packages. The package warrants review and should not be treated as clean. ENTRY index.html (main: index.html) OBFUSCATION - String Array Obfuscation in index.html: "['Bg9N','ovnIr1bjDq','Aw5MBW','y3rVCIGICMv0Dq','nJyXmZGWvMTjwxPd','nZy0nte2ywLKv..." ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern