GCVE-110-OSM-2026-11275

package.json line 11 declares the dependency 'gridster-coords' as the bare HTTPS URL https://repo.securityctrl.com/gridster-coords instead of a registry version range. On npm install, npm fetches whatever bytes that URL serves, with no version pin and no integrity check, and executes any lifecycle scripts contained in the fetched tarball on the installer's machine. The dependency key equals the package's own name (dependency-confusion shape), the version '45.0.0' is implausibly high for a package of this name, and the host repo.securityctrl.com is unrelated to any npm registry or documented publisher. The shipped source is otherwise an inert stub, so the manifest line is the entire delivery mechanism. Judge assessment: This looks like a supply-chain loader aimed at npm users: the package.json dependency is a bare HTTPS URL to repo.securityctrl.com, which bypasses registry controls and can pull arbitrary tarballs during install. The attacker model is a compromised or malicious publisher using a dependency-confusion-shaped manifest to deliver code from an external host; the OSV advisory and the plaintext IOC both corroborate that delivery mechanism. The entrypoint itself is just a benign demo stub in index.js, which makes the manifest-level URL dependency the real payload path rather than a false positive. The publisher history further strengthens the malicious assessment because sine8z already has multiple critical malware reports and a nontrivial malicious ratio. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "gridster-coords": "https://repo.securityctrl.com/gridster-coo..." DESTINATION - 2 loader (urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages